Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pressing YubiKeys

bert.org

Post reply on HN
Print view View original

201–210 of 241 posts

Re: Pressing YubiKeys

#201

Post by djur »

geocar wrote: post #186
dannyw wrote: post #164

Earlier quoted context omitted.

Security isn’t binary. This mechanism is more secure than no 2FA, because off the shelf malware isn’t gonna prod around your local network and look for a self built finger contraption. Furthermore, if someone does trigger it, the thing will move and you’ll hopefully realise you’re haxx’d.

> Security isn’t binary. I hate that people say that. By adding some security (protecting against some threat) to another security (protecting against same threat) you gain no security, after all: 1+1=1 in binary, so security is binary in this way as well. By protecting the same thing with two different security mechanisms, you have multiplication, and in binary 1×0=0 so security is binary in this way. And so on. Sec…

My YubiKey requires me to enter a PIN as well, which expires after a period of time. I don't see any significant benefit to requiring a tap after I've entered the PIN.

Re: Pressing YubiKeys

#202

Post by pkz »

"Now that we have that shell script, we can call it from other places as well. iTerm2 has a feature called Triggers, which can execute actions based on text matching a regex in your terminal. So we could write a regex to listen for “Yubikey for” and have it run the same script, eliminating the need to press buttons altogether."

But isn't the whole idea that it shouldn't be possible to trigger it from software?

Re: Pressing YubiKeys

#203

Post by corndoge »

geocar wrote: post #185

> iTerm2 has a feature called Triggers, which can execute actions based on text matching a regex in your terminal. So we could write a regex to listen for “Yubikey for” and have it run the same script, eliminating the need to press buttons altogether. Don't do this. Actually seriously, don't do most of this. The fact that your computer cannot induce the yubikey to provide its key material (or evidence of the key mate…

> Before we go any further, I’d like to acknowledge the reasons for this. If a remote attacker were to compromise your laptop, being able to trigger the YubiKey from software on the computer defeats the whole point of using the YubiKey.

Re: Pressing YubiKeys

#205

Post by wrsh07 »

dannyw wrote: post #164
wrsh07 wrote: post #107

Ways they could solve their problem without significantly compromising security: 1. Plug the yubikey into the monitor 2. Use an extension cord (as they did) 3. Switch back to an otp app (eg Google authenticator or Duo) 4. Credit to conk [1] or agl [2]: extend the conductivity via conductive foil or other material, connect to ground to simulate touch Ways you can improve convenience while reducing security: 1. This! 2…

Security isn’t binary. This mechanism is more secure than no 2FA, because off the shelf malware isn’t gonna prod around your local network and look for a self built finger contraption. Furthermore, if someone does trigger it, the thing will move and you’ll hopefully realise you’re haxx’d.

I'm not going to provide a better response than geocar, but I have two things to say:

1) I really wanted to give out the free advice that people should plug their yubikeys into their monitors. Get two so you can have one in the monitor and one in the laptop (or laptop bag). Also, you don't need a USB c key for the monitor.

2) there's the specific question of "what is the surface area of attack?" With a yubikey, you limit that surface to "people who have physical access to your device"

I didn't make the case that security is binary. I simply pointed out that they are severely compromising their security posture by re adding remote users as a surface of attack.

If someone compromises their machine and watches what steps they take to access eg a production network, the attacker will trivially see the yubikey being triggered. They don't need to know what it is or why it's being run. They'll just know that after you ssh you run this script.

Re: Pressing YubiKeys

#206

Post by peternicky »

I’ve used various yubikeys in personal environments over the past 7 years and found them to be a gimmick rather than a useful tool.

They are quite versatile and can be used for many different use cases which is part of the problem in my opinion. While not a total dummy, I found yubikey software and documentation to be difficult to use and configure and a pain to find how to setup the key for common scenarios. This brings me back to ideal users, probably corporate use where a dedicated team can support users for the specific use cases.

Re: Pressing YubiKeys

#207

Post by jlgaddis »

tialaramex wrote: post #143
dheera wrote: post #45

Earlier quoted context omitted.

Considering many services only allow one YubiKey or only one TOTP authenticator ... I might actually need a short term solution like this to beat the 2FA on those services. Otherwise what happens if I lose my key on the road? The 2FA services that allow >1 YubiKey are good, I can have a backup key locked up some place and use them as intended.

With TOTP it's very understandable to limit you to one authenticator as each additional authenticator makes it easier to attack you (meaningfully more guessed codes are now correct at any moment) and the UX is awful because there's no good way to discern one TOTP authenticator from another. WebAuthn / U2F are explicitly designed to allow multiple authenticators. The W3C WebAuthn spec. explicitly calls out that you sh…

> ... each additional authenticator makes it easier to attack you (meaningfully more guessed codes are now correct at any moment) ...

That isn't really an issue with TOTP either (if properly implemented), as each authenticator has a unique identifier and seed.

I've got multiple authenticators set up on a PayPal account. When logging in, I simply select which of the authenticators I want to use and enter the code it gives me.

Re: Pressing YubiKeys

#208

Post by jlgaddis »

dheera wrote: post #64
3np wrote: post #54

Earlier quoted context omitted.

Looking at you, AWS.

AWS, Twilio, PayPal, Coinbase, Gusto, ...

I'm not sure when they started supporting it but I've had multiple (physical and virtual) authenticators for 2FA set up on PayPal for years.

Re: Pressing YubiKeys

#209

Post by Natfan »

WrtCdEvrydy wrote: post #71
punnerud wrote: post #32

Earlier quoted context omitted.

There is also MicroBot: https://microbot.is/push/ I used it for testing smart meters in Norway, so we did not need to run to the lab to trigger events. The best part is that the whole menu is interactive by just one physical button, a great job for a Bluetooth button pusher + Python. It is also capacitive so it work on the phone screen, and YubiKeys (?)

Can you get to the 'buy now' shop on that site?

~ dig shop.microbot.is +noall +question +answer ;shop.microbot.is. IN A

DNS isn't set up right.

Re: Pressing YubiKeys

#210

Post by kyrra »

bradknowles wrote: post #166
asymptotic wrote: post #145

Earlier quoted context omitted.

FWIW Amazon / AWS also use YubiKeys.

Google and Amazon are both well known to use hardware that is similar to a Yubikey, but not exactly the same.

Google open sourced FIDO2 firmware to make a 2fa device. May not be related to Titan keys.

https://github.com/google/OpenSK

Post reply on HN