Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting the most out of YubiKeys for your business

blog.congruentlabs.co

Post reply on HN
Print view View original

21–30 of 77 posts

Re: Getting the most out of YubiKeys for your business

#21

Post by timothy-quinn »

bsder wrote: post #19

I feel like a broken record, but: If I have a startup of 5 people, how do I deploy 3 Yubikeys per person? How do I issue a new Yubikey to a person and connect it into systems if one of the old ones gets stolen? How do I disable a stolen Yubikey or all the Yubikeys if that person quits? And how do I do this when the IT department is one person a couple hours a week?

Hi! I'm actually the product manager for the product mentioned in that article: https://enterprise.signata.net.

Are you heavily SaaS based for the tools you use in your startup, or do you have some on-prem infrastructure? That'll kind of dictate which path you should go down for provisioning the keys to your users. Our product will be perfect if you're using AD & a Microsoft CA internally (or are willing to set one up), as you could then just set up 3 YubiKeys for each employee, all loaded with certificates for authentication.

And, should one be stolen or an employee leaves, just revoke the certificates on it to kill the access immediately.

Any path you go down should really still only take a bit of time upfront and almost nothing longer term, unless your team grows fast.

You can also hit me up at tim@congruentlabs.co and I can give you more advice if you don't want to mention specifics publicly.

Re: Getting the most out of YubiKeys for your business

#22

Post by twunde »

m0zg wrote: post #10

Why is there so little competition for these? $50 for a key that maybe costs $5 to manufacture (yes, including software development, at their volume) is a little too rich for my blood.

There are a few competitors: Google Titan, Thetis come to mind plus traditional smartcards. Some of the competitors only support FIDO/U2F, meaning that a number of applications like LastPass that support OTP or Smartcard won't work (if you're interested Yubikey's Security Key only supports those two protocols and only costs $20). Yubikey's build quality tends to be superior and they've got a nice plug and play UX. For many IT departments, it's easy to justify an extra $5-$10 a unit if there is minimal support needed and it's unlikely to need to be replaced due to breakage (lost devices yes, breakage no). Anecdotally I've got an older generation yubikey that appears to still work after 6-7 years

Re: Getting the most out of YubiKeys for your business

#23

Post by Exmoor »

RcouF1uZ4gsC wrote: post #15
Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

I think the intuition is that it is supposed to be like a key. People generally do a pretty good job securing their keys. In addition, it is easy to have a backup key stored somewhere safe. One nice thing about Yubikey instead of phone, is that since it only does one thing, you are far less likely to need to upgrade it. In the past, I have lost a 2 factor on my phone when upgrading since it is not backed up.

That makes sense, and initially that is how I treated it, but essentially everyone I work with keeps theirs plugged in to their laptops 24/7. In fact, the keys we get as backups/replacements are the low profile ones designed to be plugged in and not removed without significant difficulty.

Re: Getting the most out of YubiKeys for your business

#24

Post by toomuchtodo »

timothy-quinn wrote: post #14
Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

It depends on the context really - I love the push-driven MFA products, but they specifically require you as a user to be carrying a phone with you at all times, and are usually considered "low" assurance of the user's identity. If your business is seeking "higher" assurance (yes, assurance levels are very subjective) then certificate-based MFA can meet the needs better. Or, if your business is working with sensitive…

If you can’t use a phone as a factor, it’s likely you’ll be issued a smart card (such as a CAC in the case of the military).

It feels like Yubikeys are a shim until the phone UX as a factor improves (and there’s more server side support) and/or smart card adoption for identity improves. If Touch ID and Face ID are good enough for most secure transactions in the Apple ecosystem (including Apple Pay), seems like a reasonably high assurance.

Re: Getting the most out of YubiKeys for your business

#25

Post by mcpherrinm »

Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

TouchID on macs are another reasonable option.

My employer uses Duo, which supports phone push, yubikeys, or webauthn/touchID in chrome.

I almost always use touch ID. I do have a yubikey and phone push as a backup, but I really want to minimize using my personal device for work (and don't want to carry two phones).

A yubikey is much less obnoxious to carry around than an extra phone.

Re: Getting the most out of YubiKeys for your business

#26

Post by closeparen »

Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

You leave the Yubikey in your computer, at least for the duration of your session, so you're just moving your hand a couple of inches to tap it. Contrast with fishing out an entirely different device, waiting for the push to arrive or navigating to the Duo app, etc. Push 2FA is also subject to the vagaries of your phone's current network connection and its latency.

For the specific combination of Macs with Touchbar and U2F and Chrome, you can already get this experience with onboard hardware. I expect most client devices will converge on having some kind of hardware-backed U2F credential built in. But Yubikey is more general right now. OTP is easy to implement and eminently compatible; it just presents as a keyboard and sends keystrokes. HMAC is great for not just authenticating but signing specific transactions. The GPG applet is just another GPG key, and the PIV applet is just another X.509 cert, so a number of applications can be upgraded to hardware-backed credentials with little or no change.

Re: Getting the most out of YubiKeys for your business

#27

Post by graton »

Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

Well that is kind of the the point of multi-factor authentication.

* Something you know (your username/password).

* Something you have. The Yubikey or other hardware token.

If you lose your Yubikey, by itself it should not allow access to anything. I keep mine on my keyring with my keys, which I haven't lost yet.

Re: Getting the most out of YubiKeys for your business

#28

Post by graton »

One nit about this article. It claims that the Yubikey does not support TOTP (Time-based One Time Code). I believe all of the Gen 5 versions that plug into your computer's USB port support TOTP.

There is an app called Yubico Authenticator that can scan for a QR code on your screen and import the secret key from a website, into the Yubikey, when setting up TOTP as supported by Google Authenticator. You can also require a touch in order to generate the One Time Code, which I would recommend.

Re: Getting the most out of YubiKeys for your business

#29

Post by closeparen »

toomuchtodo wrote: post #24
timothy-quinn wrote: post #14

Earlier quoted context omitted.

It depends on the context really - I love the push-driven MFA products, but they specifically require you as a user to be carrying a phone with you at all times, and are usually considered "low" assurance of the user's identity. If your business is seeking "higher" assurance (yes, assurance levels are very subjective) then certificate-based MFA can meet the needs better. Or, if your business is working with sensitive…

If you can’t use a phone as a factor, it’s likely you’ll be issued a smart card (such as a CAC in the case of the military). It feels like Yubikeys are a shim until the phone UX as a factor improves (and there’s more server side support) and/or smart card adoption for identity improves. If Touch ID and Face ID are good enough for most secure transactions in the Apple ecosystem (including Apple Pay), seems like a reas…

Some of the U2F-only tokens are their own thing, but the flagship Yubikey is literally a smart card bundled with a reader. The USB token form factor makes a little more sense for an individually assigned laptop.

Re: Getting the most out of YubiKeys for your business

#30

Post by timothy-quinn »

graton wrote: post #28

One nit about this article. It claims that the Yubikey does not support TOTP (Time-based One Time Code). I believe all of the Gen 5 versions that plug into your computer's USB port support TOTP. There is an app called Yubico Authenticator that can scan for a QR code on your screen and import the secret key from a website, into the Yubikey, when setting up TOTP as supported by Google Authenticator. You can also requir…

Oh yeah good point, I always forget about the OATH part of the YubiKeys - unfortunately it's like the OTP feature in that I haven't had enterprise customers asking me about it at all (they're all hyped about U2F), so I start to forget its there.

I'll have to add it in to the article :)

Post reply on HN