91–100 of 241 posts
Why not just keep the wire attached to the Yubi-key, but leave it electrically floating (high-impedance state) and have the board ground it whenever it needs to be pressed? No need for mechanical triggers...
Earlier quoted context omitted.
It would be better to use a software TOTP authenticator with backups. You could also store multiple encrypted copies of the TOTP secret encrypted with different Yubikeys. I don't know if there's any software that does this automatically and momentarily decrypts the TOTP secret into a secure memory location when you need it. That preserves... most of the benefit of 2fa.
Storing copies of a TOTP secret is as good as just having 2 high-entropy passwords and saving multiple copies of one of them in clear text, which is not more secure than having 2 high-entropy passwords and not storing them anywhere, and which is equivalent to just 1 doubly-high-entropy password not stored anywhere. The fact that you can store copies effectively defeats the purpose of 2FA. One of the reasons to have m…
One reason to have multiple copies of the TOTP secret is to not be locked out of accounts should one lose their 2FA token. For example, if one has two copies of the TOTP secret, one of which is in a secure location, and one of which is used for daily purposes, as long as the secure location is reasonably secure, it's not much different than storing backup codes in that secure location.
I do agree with you that having multiple copies of the TOTP secret that can be lost and not noticed isn't a good idea though.
Earlier quoted context omitted.
> Yubikeys don't have an onboard battery-backed clock, so they can't give out timestamped responses. Ok got it and we can't trust the host PC clock or any web based clock via host pc...
Correct - just like an evildoer who had your yubikey could generate and save a bunch of yubikey key strings, they could also generate and save a bunch of time-based codes for times in the future by changing the host clock. You can use a bidirectional challenge-response between the yubikey and a trusted server - that's what U2F does. But honestly, if an attacker has both your password and physical possession of your 2…
U2F is a different animal though. The question is then: does timestamping the response reduce the attack surface enough compared to the downsides? I'd argue yes since the described attack can offset a failed login and the actual attack after a MITM. Also, it is probably possible to get the time-stamp within the kernel. If your root is compromised you're also done for.
The obvious next step is to plug this into a server and control it through USB over IP. Call it "remote, centrally controlled 2FA" and your manager will love it!
There are these RSA-brand tokens that show a new TOTP number every few minutes. Occasionally people find an unsecured webcam pointed at one of those somewhere on the internet...
Cause if it's only capacitative there is an easier way:
The obvious next step is to plug this into a server and control it through USB over IP. Call it "remote, centrally controlled 2FA" and your manager will love it!
Does the yubikey sense both force AND capacitative touch? Cause if it's only capacitative there is an easier way: https://www.youtube.com/watch?v=JDgDMBquBw0
The obvious next step is to plug this into a server and control it through USB over IP. Call it "remote, centrally controlled 2FA" and your manager will love it!
I remember a story about how our (third party) security operations center doesn’t allow phones on the floor, but most of its customers use Duo Push. So there is a table in the middle of the floor with all the 2FA phones bolted to it.
Earlier quoted context omitted.
AWS, Twilio, PayPal, Coinbase, Gusto, ...
PayPal? All I've ever seen in there is TOTP and SMS
They should ideally support >1 TOTP authenticator if they don't intend to support U2F.
I don't want SMS as a backup option; I have deprecated SMS, it's old tech and needs to die along with telegrams.