Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting the most out of YubiKeys for your business

blog.congruentlabs.co

Post reply on HN
Print view View original

31–40 of 77 posts

Re: Getting the most out of YubiKeys for your business

#31

Post by techslave »

Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

in california, if your employer requires you to have a phone for 2FA or other purposes, they must reimburse you at least partially. yubikeys are cheaper.

as to being clunky, it’s because your employer doesn’t care about it, so you have the clunky (and much cheaper) yubikeys.

lack of verification of who is using it is simply not an important part of the threat model.

Re: Getting the most out of YubiKeys for your business

#32

Post by techslave »

timothy-quinn wrote: post #21
bsder wrote: post #19

I feel like a broken record, but: If I have a startup of 5 people, how do I deploy 3 Yubikeys per person? How do I issue a new Yubikey to a person and connect it into systems if one of the old ones gets stolen? How do I disable a stolen Yubikey or all the Yubikeys if that person quits? And how do I do this when the IT department is one person a couple hours a week?

Hi! I'm actually the product manager for the product mentioned in that article: https://enterprise.signata.net . Are you heavily SaaS based for the tools you use in your startup, or do you have some on-prem infrastructure? That'll kind of dictate which path you should go down for provisioning the keys to your users. Our product will be perfect if you're using AD & a Microsoft CA internally (or are willing to set one…

did you not read the question? it’s 5 ppl and either outside IT or random joe employee 1-2 hrs per week. they are not managing AD and CA infrastructure.

Re: Getting the most out of YubiKeys for your business

#33

Post by timothy-quinn »

techslave wrote: post #32
timothy-quinn wrote: post #21

Earlier quoted context omitted.

Hi! I'm actually the product manager for the product mentioned in that article: https://enterprise.signata.net . Are you heavily SaaS based for the tools you use in your startup, or do you have some on-prem infrastructure? That'll kind of dictate which path you should go down for provisioning the keys to your users. Our product will be perfect if you're using AD & a Microsoft CA internally (or are willing to set one…

did you not read the question? it’s 5 ppl and either outside IT or random joe employee 1-2 hrs per week. they are not managing AD and CA infrastructure.

Yeah that's why I added the "if" - But I have seen a lot of very small teams running AD (or Azure AD if they've chosen the Microsoft path), but they tend to just be paranoid about security or running in countries with poor internet connections.

Microsoft also provide pretty cheap deals for startups if they want some basic infrastructure for the office (excluding the hardware of course), so it's not entirely out of the equation on the licencing side either.

Really small teams typically will find U2F auth easiest to work with in the beginning, and then after hitting like 20 users they'll bump into problems like a large enough number of connected systems that they need to manage 2FA for.

Re: Getting the most out of YubiKeys for your business

#34

Post by jwr »

YubiKeys are absolutely fantastic, and under-rated, too.

I used this guide: https://github.com/drduh/YubiKey-Guide to set up my YubiKeys with GPG keys that are also used as SSH keys. This gives me, in a single setup:

* secure 2FA for sites with WebAuthN * ability to encrypt backups and other information using GPG, with decryption only possible with a physical device * ability to securely log in via SSH to all my infrastructure

I use keys, in case one gets lost. I did try to use the PIV features, but I just don't live in a world where this is useful — but the FIDO2 and GPG functionality is fantastic in itself!

Re: Getting the most out of YubiKeys for your business

#35

Post by neuralzen »

Actually just started some work on some biometric FIDO2 webapp testing, and there are frustratingly few device options available to use for testing, particularly in linux. It works fine on most modern mobile devices, but I need to get into the guts of things, so I need an actual FIDO2 biometric device so it has been a little frustrating. - I don't suppose anyone knows of any device emulators/simulators our there, to test a webapp?

Re: Getting the most out of YubiKeys for your business

#36

Post by deadbunny »

jwr wrote: post #34

YubiKeys are absolutely fantastic, and under-rated, too. I used this guide: https://github.com/drduh/YubiKey-Guide to set up my YubiKeys with GPG keys that are also used as SSH keys. This gives me, in a single setup: * secure 2FA for sites with WebAuthN * ability to encrypt backups and other information using GPG, with decryption only possible with a physical device * ability to securely log in via SSH to all my infr…

Same use case here. While setting up the yubikey with the gpgkeys is a long process it's totally worth it in my opinion.

Re: Getting the most out of YubiKeys for your business

#37

Post by michaelt »

m0zg wrote: post #10

Why is there so little competition for these? $50 for a key that maybe costs $5 to manufacture (yes, including software development, at their volume) is a little too rich for my blood.

I suspect YubiKey doesn't face price competition from the cheap AliExpress USB flash drive manufacturers because a U2F token from a no-name supplier isn't much better than a mobile app.

Re: Getting the most out of YubiKeys for your business

#38

Post by blattimwind »

Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

You can MITM OTP, but you can't MITM U2F. You can copy/steal the OTP secret from a phone app, but you can't copy/steal the U2F private key from a Yubikey (easily).

Re: Getting the most out of YubiKeys for your business

#39

Post by antoinealb »

m0zg wrote: post #10

Why is there so little competition for these? $50 for a key that maybe costs $5 to manufacture (yes, including software development, at their volume) is a little too rich for my blood.

It is probably more pricing of different products in their selection. If you just need U2F you can get their security keys [0] for 20$. 18$ if you order 50, and probably even cheaper if you ask for > 1000 (i.e. an entreprise customer).

And 5$ manufacturing for 20$ resale is pretty much a standard ratio in consumer goods. I would also argue that a competitor would have a hard time making those at only 5$, making it harder to compete based on price alone.

[0] https://www.yubico.com/product/security-key-by-yubico

Re: Getting the most out of YubiKeys for your business

#40

Post by [deleted] »

tialaramex wrote: post #20
ykevinator wrote: post #8

Virtually every u2f implementation I've ever seen allows otp as a backup, reducing the security of one to the other. U2f is so much nicer than otp but hardware keys have devolved to being convenient not more secure than otp.

Just because you're allowed to do OTP backup doesn't require you to switch it on. If you have two FIDO keys that's fine. What isn't fine is one FIDO key and no other backup. The good ones aren't fragile, but you can still easily lose them. If there's a site you use on the phone too, newer Android devices which know how to keep a secret (e.g. a Pixel) can do WebAuthn for themselves and be that second option for you.

[deleted]
Post reply on HN