81–90 of 241 posts
"If you work in tech, you probably have a YubiKey" The author must live in some kind of bubble. This may only be true at Big Tech companies or other companies with a atypically strong security focus.
I hope for their customers' sakes they have solved their reliability problem.
Earlier quoted context omitted.
It would be better to use a software TOTP authenticator with backups. You could also store multiple encrypted copies of the TOTP secret encrypted with different Yubikeys. I don't know if there's any software that does this automatically and momentarily decrypts the TOTP secret into a secure memory location when you need it. That preserves... most of the benefit of 2fa.
Storing copies of a TOTP secret is as good as just having 2 high-entropy passwords and saving multiple copies of one of them in clear text, which is not more secure than having 2 high-entropy passwords and not storing them anywhere, and which is equivalent to just 1 doubly-high-entropy password not stored anywhere. The fact that you can store copies effectively defeats the purpose of 2FA. One of the reasons to have m…
> to plug this [Yubikey] into a server and control it through USB over IP.
Obviously multiple Yubikeys is the only real solution.
"If you work in tech, you probably have a YubiKey" The author must live in some kind of bubble. This may only be true at Big Tech companies or other companies with a atypically strong security focus.
Earlier quoted context omitted.
It would be better to use a software TOTP authenticator with backups. You could also store multiple encrypted copies of the TOTP secret encrypted with different Yubikeys. I don't know if there's any software that does this automatically and momentarily decrypts the TOTP secret into a secure memory location when you need it. That preserves... most of the benefit of 2fa.
"better" is a strange word to use when discussing security, everyone's situation is different™. You're making a set of trade-offs between availability (backups) and confidentiality (only using hardware tokens which are tamper evident) which absolutely do not generalize to every case.
It makes me laugh that such a small problem (pressing a yubikey at an awkward angle, which sometimes doesn't register properly) can be solved with such a delightful over engineered solution.
It seems like you don't understand the main advantage of these types of security tokens. Rogue trigger of a security token isn't really an issue when using the recommended U2F standard. U2F uses the domain as part of the challenge-response in U2F so that phishing\spoofing attacks can be defeated.
You can do the entire OTP entirely in software. Just be sure that the location you place the secret is encrypted:
https://battlepenguin.com/tech/replacing-okta-verify-with-op...
The obvious next step is to plug this into a server and control it through USB over IP. Call it "remote, centrally controlled 2FA" and your manager will love it!
Considering many services only allow one YubiKey or only one TOTP authenticator ... I might actually need a short term solution like this to beat the 2FA on those services. Otherwise what happens if I lose my key on the road? The 2FA services that allow >1 YubiKey are good, I can have a backup key locked up some place and use them as intended.
At work we use to use the old Yubi keys that were nice and long and had a good contact areas. Then they switched to the nanos and wouldn't reprogram the old ones (or even order the larger ones of the same generation, or let us pay for them ourselves). You can do the entire OTP entirely in software. Just be sure that the location you place the secret is encrypted: https://battlepenguin.com/tech/replacing-okta-verify-w…