Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pressing YubiKeys

bert.org

Post reply on HN
Print view View original

141–150 of 241 posts

Re: Pressing YubiKeys

#141

Post by Nextgrid »

dzhiurgis wrote: post #118

Google won’t let you setup 2FA without adding a phone number which kind of sets you up for sun swapping attack by design... My biggest beef is lack of NFC in MacBook. I wan’t a key in card factor because who the hell has keys these days. Maybe add hardware button on the card. It would work on on mobile and laptops. Banks could use their own credit cards for logging in...

I'm sure this is just a scummy way of getting the phone number of the user. In most cases you can remove the phone number afterwards.

Re: Pressing YubiKeys

#142

Post by Nextgrid »

detaro wrote: post #75
jeroenhd wrote: post #19

The obvious next step is to plug this into a server and control it through USB over IP. Call it "remote, centrally controlled 2FA" and your manager will love it!

There are these RSA-brand tokens that show a new TOTP number every few minutes. Occasionally people find an unsecured webcam pointed at one of those somewhere on the internet...

I've recently had to set up something like this, though I put it behind an IPSec gateway to provide some kind of security.

Re: Pressing YubiKeys

#143

Post by tialaramex »

dheera wrote: post #45
jeroenhd wrote: post #19

The obvious next step is to plug this into a server and control it through USB over IP. Call it "remote, centrally controlled 2FA" and your manager will love it!

Considering many services only allow one YubiKey or only one TOTP authenticator ... I might actually need a short term solution like this to beat the 2FA on those services. Otherwise what happens if I lose my key on the road? The 2FA services that allow >1 YubiKey are good, I can have a backup key locked up some place and use them as intended.

With TOTP it's very understandable to limit you to one authenticator as each additional authenticator makes it easier to attack you (meaningfully more guessed codes are now correct at any moment) and the UX is awful because there's no good way to discern one TOTP authenticator from another.

WebAuthn / U2F are explicitly designed to allow multiple authenticators. The W3C WebAuthn spec. explicitly calls out that you should allow users to register more than one authenticator, and might want to provide a nice way for your users to label them, e.g. "Yubikey", "iPhone", "Greg's key" or whatever. Every site I've used that offers WebAuthn does this correctly except AWS and you'd have to take that up with Amazon.

Re: Pressing YubiKeys

#144

Post by Cactus2018 »

sxp wrote: post #24

When I was at Google around 2012, the company had a custom 2FA dongle that detected motion rather than touch. An engineer who had remotely ssh'd into their workstation needed to 2FA and realized that they could send an SMS to their phone, cause the phone to vibrate, and trigger a false 2FA event on the dongle. (Or maybe they got their computer to play a loud noise. I forgot the specific details.) Similar to this fake…

Reminds me of urban legend of the team who pointed a webcam at the RSA token

https://www.google.com/search?q=webcam+rsa+token&source=lnms...

Re: Pressing YubiKeys

#145

Post by asymptotic »

miked85 wrote: post #139
KerryJones wrote: post #136

> If you work in tech, you probably have a YubiKey That is a gross overstatement. As someone who works for a pre-IPO startup and been in the bay in various startups for a number of years, I'd hazard that only 5-10% of the engineers had YubiKey, let alone "work in tech". Whether or not we _should_ is another question.

This seemed odd to me as well - anecdata, but I have yet to work at any company that uses YubiKeys, I have only heard that FB does.

FWIW Amazon / AWS also use YubiKeys.

Re: Pressing YubiKeys

#146

Post by dmm »

JxLS-cpgbe0 wrote: post #132
walrus01 wrote: post #115

Earlier quoted context omitted.

It's all good until you consider the need to periodically replace the hotdog every day or two, as it gets rotten at room temperature.

You just need to use a meat product that's so full of preservatives it can't possibly rot https://interestingengineering.com/mcdonalds-burger-survives...

A McDonalds hamburger patty is just beef, salt, and pepper. It was preserved by an environment that allowed it to dry out before spoiling.

Re: Pressing YubiKeys

#147

Post by dmm »

tialaramex wrote: post #140
dzhiurgis wrote: post #118

Google won’t let you setup 2FA without adding a phone number which kind of sets you up for sun swapping attack by design... My biggest beef is lack of NFC in MacBook. I wan’t a key in card factor because who the hell has keys these days. Maybe add hardware button on the card. It would work on on mobile and laptops. Banks could use their own credit cards for logging in...

If you've got adversaries doing a sun swapping attack you are in a Rick and Morty episode not the real world. I can't swear Google has never known one my phone numbers in the many, many years I've had an account, though they don't have one recorded now. However I can tell you with certainty I have three WebAuthn authenticators, and no SMS-style 2FA authorised on my Google account now.

> If you've got adversaries doing a sun swapping attack you are in a Rick and Morty episode not the real world.

It happened to Jack Dorsey. And attacks tend to become easier over time. Any employee of an at&t store could do it to you right now.

The reason we know Dorsey was the victim of a sim swap attack is probably that he's important enough that when he was hacked he couldn't be dismissed with the "You probably messed up and leaked your password" dismissal.

Re: Pressing YubiKeys

#148

Post by f0ff »

xkcd-sucks wrote: post #52
f0ff wrote: post #9

Congratulations, you've defeated the purpose of having a YubiKey

> the purpose of having a YubiKey Compliance?

I'd hazard saying that the purpose of a YubiKey is to provide two factor authentication. A YubiKey acts as an item, posession of which implies identity. When you allow for the YubiKey to be activated without human interaction, it's moved from domain of posession into the domain of knowledge - identifying party needs to know where to knock, not to possess they key. It's no better than appending the URL at the end of your password.

If you allow for a YubiKey, or any other physical artifact in that matter, to be remotely invoked it negates its utility as an authentication factor in the physical domain.

Re: Pressing YubiKeys

#149

Post by dheera »

tialaramex wrote: post #143
dheera wrote: post #45

Earlier quoted context omitted.

Considering many services only allow one YubiKey or only one TOTP authenticator ... I might actually need a short term solution like this to beat the 2FA on those services. Otherwise what happens if I lose my key on the road? The 2FA services that allow >1 YubiKey are good, I can have a backup key locked up some place and use them as intended.

With TOTP it's very understandable to limit you to one authenticator as each additional authenticator makes it easier to attack you (meaningfully more guessed codes are now correct at any moment) and the UX is awful because there's no good way to discern one TOTP authenticator from another. WebAuthn / U2F are explicitly designed to allow multiple authenticators. The W3C WebAuthn spec. explicitly calls out that you sh…

> discern one TOTP authenticator from another

Just match the code the user entered against all registered authenticators. Limit the number of authenticators to maybe 3-4 per account.

Re: Pressing YubiKeys

#150

Post by f0ff »

BeaglePlaza wrote: post #122
animationwill wrote: post #99

Earlier quoted context omitted.

I don't understand the threats, risk, or solution here.

Threat is that the mobile devices could be used to 1) photograph proprietary systems, 2) exfil data over mobile networks or potentially introduce 3) malware via usb ports. I don't really get how bolting the devices is a solution for enabling 2FA, unless the access console is also at the same location. But it would prevent 1) and 3).

As long as the table is bolted to the floor, you're replacing posession (of a phone) factor, with location (in SOC) factor. Keeps both client happy, and security architect sleeping soundly.

Nice solution.

Post reply on HN