To those that have yubikeys: are they actually durable enough to keep on a key chain?
Yubico launches its dual USB-C and Lightning two-factor security key
121–130 of 178 posts
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#122To those that have yubikeys: are they actually durable enough to keep on a key chain?
The USB-A versions are practically speaking indestructible. I've had them for over 10 years now without any problems.
The USB-C versions look much more fragile though...
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#123This is awesome, been waiting for this for quite a while. The Google Titan bluetooth support never worked on my phone so it’s cool that I can plug it in directly now with this YubiKey.
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#124That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would a…
Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of…
> Github is an example, you can always trigger the fallback SMS 2fa code.
You can setup OTP (no SMS) and either keep it as a backup, or destroy the key. I don't have SMS on Github.
Admittedly, it won't solve issues with all services. From the service perspective, dealing with users who lost their security key (or don't have a backup one) is too painful wrt to forcing you to have an alternative.
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#125To those that have yubikeys: are they actually durable enough to keep on a key chain?
I've had a YubiKey5 which uses the standard USB for a while and never had issues. They’re also cheap enough to replace easily but I doubt it'll break by it being in your pocket with other keys unless you severely bend it or something.
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#126I tried the quiz to get a recommendation but it finishes in an endless loop > learn more > quiz starts again https://www.yubico.com/quiz/ Also can anyone explain the multiple models too me? https://www.yubico.com/products/yubikey-hardware/ Say I want an USB-A key, I can choose from three and they all have different prices. The Security Keys are less secure than a FIPS or a 5? Maybe I'm just too end user but the multi…
Short version: the FIPS is for enterprise. The Security Key is for consumers. The 5 series is for enterprise or power users. This might be more useful for you: https://www.yubico.com/products/yubikey-hardware/compare-pro... You want the Yubikey FIPS if you're using it in a context where FIPS compliance matters, such as US government. If not (such as for personal use), then don't bother. The Security Key series is the…
The Yubikey requires a password by default to use the ssh key stored on it and it will lock itself after 3 failed attempts. So I don’t think your caveat is valid.
I rather have my encryption key on hardware design to keep anyone who finds it from brute forcing it than just password protected on a hard drive.
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#127Handy table comparing their 5-series options: * https://www.yubico.com/products/yubikey-hardware/compare-yub... Seems the main questions to ask yourself are: * is NFC desired? * do you need/want USB-A or USB-C? This product adds a Lightning option.
Is there no lightning to USB A adapter? Seems a bit wasteful to buy another key for a currently very limited ability in iOS.
There is, but the number of USB classes supported by iOS is limited.
I think implementing new ones is not possible for applications without licensing MFi (which is incurring fees per unit sold, as far as I understand).
The way they are doing it, Yubico doesn't need to pay/pass through that fee on each key sold, but only on the ones actually likely to be used with iOS devices.
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#128To those that have yubikeys: are they actually durable enough to keep on a key chain?
The USB-A versions are practically speaking indestructible. I've had them for over 10 years now without any problems. The USB-C versions look much more fragile though...
They actually feel very robust. I've been carrying mine around on a keychain in my pocket for a year now and it works flawlessly.
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#129> Security keys offer almost unbeatable security and can protect against a variety of threats, including nation-state attackers. Alright, I'm not a security expert, but I'm not completely illiterate to basic computer security. Anyone care to chime in how this is much more secure than a two-factor app? Sure there's the obvious, nobody can just copy the two-factor app off my phone with all the codes and have the same c…
Simple: security keys combat phishing, two-factor apps do not. A security key doesn't just authenticate you to a site: it also authenticates the site to you.
I think I get what you are trying to express, but rather than "it authenticates the site to you", I think that should be phrased "it prevents you from authenticating at a site pretending to be some other site.
evil.com can still claim to be mysite.com and trick users into using their security key there, no?
It would presumably have to trick the user into "registering again" since there is no valid key handle for FIDO2 (not sure about classic U2F), but I doubt that users would notice the difference in flows.
The real win is that this spoof would still not give evil.com a credential scoped to mysite.com, but a user would be none the wiser that they are on a different site than they expect (which can still be problematic depending on the nature of the site).
Re: Yubico launches its dual USB-C and Lightning two-factor security key
#130> Security keys offer almost unbeatable security and can protect against a variety of threats, including nation-state attackers. Alright, I'm not a security expert, but I'm not completely illiterate to basic computer security. Anyone care to chime in how this is much more secure than a two-factor app? Sure there's the obvious, nobody can just copy the two-factor app off my phone with all the codes and have the same c…
It isn't. SW can be updated and is usually open-source and mostly secure. HW not so. At least two HW backdoors have been found in chips such as this one in earlier versions, the first using an improper RSALib RSA variant (developed by NSA or Mossad). The source for the second, SCADA, is unknown. So any nation state wanting the most people to use it, will advertise it as such. "unbeatable security and can protect agai…
The firmware not being updateable is a desired property of most security keys, actually. At least Yubico considers the risk of compromises through firmware updates as too high: https://support.yubico.com/support/solutions/articles/150000...
Obviously they are biased – they are in the business of selling hardware, not software, but their reasoning still makes sense to me.
It's arguable whether "destructive updates" that invalidate all existing registrations should be allowed, but that could have its own problems in terms of availability if not clearly communicated.
On a related note, I wonder if there is actually a more secure way of preventing illegitimate firmware updates in JavaCard/GlobalPlatform than randomizing the card manager keys, which is what Yubico does for the NEO: https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...