Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pressing YubiKeys

bert.org

Post reply on HN
Print view View original

131–140 of 241 posts

Re: Pressing YubiKeys

#131

Post by SahAssar »

tuatoru wrote: post #81
etaioinshrdlu wrote: post #73

"If you work in tech, you probably have a YubiKey" The author must live in some kind of bubble. This may only be true at Big Tech companies or other companies with a atypically strong security focus.

Used to have some (actually, I still do, in a drawer) but gave up on them several years ago after random mysterious failures - just going dead after a few months. I hope for their customers' sakes they have solved their reliability problem.

I have one that I had on my keyring for over a year, including during a swim in the ocean (I forgot I had it on me). It still works. Perhaps you got a bad batch?

Re: Pressing YubiKeys

#132

Post by JxLS-cpgbe0 »

walrus01 wrote: post #115
taldo wrote: post #110

Urban myth: somebody taped a hotdog to the CD drive tray of their workstation, and put the yubikey right in front of it. Then, whenever they needed to touch the YK while not physically in front of the workstation, a quick `eject /dev/cdrom` did the trick ;)

It's all good until you consider the need to periodically replace the hotdog every day or two, as it gets rotten at room temperature.

You just need to use a meat product that's so full of preservatives it can't possibly rot

https://interestingengineering.com/mcdonalds-burger-survives...

Re: Pressing YubiKeys

#133

Post by fomine3 »

closeparen wrote: post #53
jeroenhd wrote: post #19

The obvious next step is to plug this into a server and control it through USB over IP. Call it "remote, centrally controlled 2FA" and your manager will love it!

I remember a story about how our (third party) security operations center doesn’t allow phones on the floor, but most of its customers use Duo Push. So there is a table in the middle of the floor with all the 2FA phones bolted to it.

Why not use Android Emulator?

Re: Pressing YubiKeys

#134

Post by developer2 »

dheera wrote: post #64
3np wrote: post #54

Earlier quoted context omitted.

Looking at you, AWS.

AWS, Twilio, PayPal, Coinbase, Gusto, ...

Holy crap. I've avoided buying a U2F/FIDO2 device (eg. YubiKey) for a few years thus far, as I'm "happy enough" with TOTP. I know the differences in terms of implementation/security, but not enough services even offer TOTP, let alone the U2F/FIDO2 protocols. It's not worth the investment right now for how generally unsupported it is.

Do most services that support such devices really only support a single key/device? Do they offer the same one-time recovery codes that are generally offered with TOTP (though the storage/security of such codes server-side is dubious), for the eventual failure of the Yubikey (not if, but when)? Surely a tiny hardware device reaching the end of its lifespan doesn't mean you lose access to your account.

Re: Pressing YubiKeys

#135

Post by panda88888 »

walrus01 wrote: post #115
taldo wrote: post #110

Urban myth: somebody taped a hotdog to the CD drive tray of their workstation, and put the yubikey right in front of it. Then, whenever they needed to touch the YK while not physically in front of the workstation, a quick `eject /dev/cdrom` did the trick ;)

It's all good until you consider the need to periodically replace the hotdog every day or two, as it gets rotten at room temperature.

Any capacitive stylus would probably work.

Re: Pressing YubiKeys

#136

Post by KerryJones »

> If you work in tech, you probably have a YubiKey

That is a gross overstatement. As someone who works for a pre-IPO startup and been in the bay in various startups for a number of years, I'd hazard that only 5-10% of the engineers had YubiKey, let alone "work in tech".

Whether or not we _should_ is another question.

Re: Pressing YubiKeys

#137

Post by re »

np1810 wrote: post #36
sxp wrote: post #24

When I was at Google around 2012, the company had a custom 2FA dongle that detected motion rather than touch. An engineer who had remotely ssh'd into their workstation needed to 2FA and realized that they could send an SMS to their phone, cause the phone to vibrate, and trigger a false 2FA event on the dongle. (Or maybe they got their computer to play a loud noise. I forgot the specific details.) Similar to this fake…

More on defeating 2FA, during my internship at Amazon I created a grease monkey script that would store 'n' yubikey codes and paste them automatically whenever browser asked for a yubikey code and this worked flawlessly because afaik yubikeys code have No Expiry ... they just have to be used in order of their generation... I highlighted this issue of No Expiry of yubikey codes but no one took it seriously...

They don't expire, but using a later one will invalidate any earlier-generated ones.

https://developers.yubico.com/OTP/OTPs_Explained.html

Re: Pressing YubiKeys

#138

Post by np1810 »

re wrote: post #137
np1810 wrote: post #36

Earlier quoted context omitted.

More on defeating 2FA, during my internship at Amazon I created a grease monkey script that would store 'n' yubikey codes and paste them automatically whenever browser asked for a yubikey code and this worked flawlessly because afaik yubikeys code have No Expiry ... they just have to be used in order of their generation... I highlighted this issue of No Expiry of yubikey codes but no one took it seriously...

They don't expire, but using a later one will invalidate any earlier-generated ones. https://developers.yubico.com/OTP/OTPs_Explained.html

> They don't expire, but using a later one will invalidate any earlier-generated ones.

> https://developers.yubico.com/OTP/OTPs_Explained.html

Yes exactly... so script used to use them in order of their generation... FIFO basically...

Re: Pressing YubiKeys

#139

Post by miked85 »

KerryJones wrote: post #136

> If you work in tech, you probably have a YubiKey That is a gross overstatement. As someone who works for a pre-IPO startup and been in the bay in various startups for a number of years, I'd hazard that only 5-10% of the engineers had YubiKey, let alone "work in tech". Whether or not we _should_ is another question.

This seemed odd to me as well - anecdata, but I have yet to work at any company that uses YubiKeys, I have only heard that FB does.

Re: Pressing YubiKeys

#140

Post by tialaramex »

dzhiurgis wrote: post #118

Google won’t let you setup 2FA without adding a phone number which kind of sets you up for sun swapping attack by design... My biggest beef is lack of NFC in MacBook. I wan’t a key in card factor because who the hell has keys these days. Maybe add hardware button on the card. It would work on on mobile and laptops. Banks could use their own credit cards for logging in...

If you've got adversaries doing a sun swapping attack you are in a Rick and Morty episode not the real world.

I can't swear Google has never known one my phone numbers in the many, many years I've had an account, though they don't have one recorded now. However I can tell you with certainty I have three WebAuthn authenticators, and no SMS-style 2FA authorised on my Google account now.

Post reply on HN