161–170 of 241 posts
> If you work in tech, you probably have a YubiKey That is a gross overstatement. As someone who works for a pre-IPO startup and been in the bay in various startups for a number of years, I'd hazard that only 5-10% of the engineers had YubiKey, let alone "work in tech". Whether or not we _should_ is another question.
Adaprox has various "finger bots" for those who don't want to build their own: https://www.adaprox.io/
This is all great, but not steampunk enough ;) Check this out: https://www.youtube.com/watch?v=l-fcfGwepog Now, electrifying that would be neat!
Urban myth: somebody taped a hotdog to the CD drive tray of their workstation, and put the yubikey right in front of it. Then, whenever they needed to touch the YK while not physically in front of the workstation, a quick `eject /dev/cdrom` did the trick ;)
if mount | grep cdrom ; then
echo hotdog
else
echo nothotdog
fiWays they could solve their problem without significantly compromising security: 1. Plug the yubikey into the monitor 2. Use an extension cord (as they did) 3. Switch back to an otp app (eg Google authenticator or Duo) 4. Credit to conk [1] or agl [2]: extend the conductivity via conductive foil or other material, connect to ground to simulate touch Ways you can improve convenience while reducing security: 1. This! 2…
Earlier quoted context omitted.
This seemed odd to me as well - anecdata, but I have yet to work at any company that uses YubiKeys, I have only heard that FB does.
FWIW Amazon / AWS also use YubiKeys.
Earlier quoted context omitted.
I don't understand the threats, risk, or solution here.
Threat is that the mobile devices could be used to 1) photograph proprietary systems, 2) exfil data over mobile networks or potentially introduce 3) malware via usb ports. I don't really get how bolting the devices is a solution for enabling 2FA, unless the access console is also at the same location. But it would prevent 1) and 3).
Adaprox has various "finger bots" for those who don't want to build their own: https://www.adaprox.io/
There is also MicroBot: https://microbot.is/push/ I used it for testing smart meters in Norway, so we did not need to run to the lab to trigger events. The best part is that the whole menu is interactive by just one physical button, a great job for a Bluetooth button pusher + Python. It is also capacitive so it work on the phone screen, and YubiKeys (?)
Apple Touch Id on Macbooks is pretty much YubiKey replacement, right?