The keyboard is sooo cool!
Yeah, it's sweet. "1976" keycaps.
https://drop.com/buy/nineteenseventysix-sa-keycap-set
Pressing YubiKeys
211–220 of 241 posts
Re: Pressing YubiKeys
#212"If you work in tech, you probably have a YubiKey". I stopped reading here.
Re: Pressing YubiKeys
#213He never heard of a solenoid?
Solenoids are too abrupt for a "finger-push" actuation. The rack-and-pinion is a very good approximation
Re: Pressing YubiKeys
#214Ways they could solve their problem without significantly compromising security: 1. Plug the yubikey into the monitor 2. Use an extension cord (as they did) 3. Switch back to an otp app (eg Google authenticator or Duo) 4. Credit to conk [1] or agl [2]: extend the conductivity via conductive foil or other material, connect to ground to simulate touch Ways you can improve convenience while reducing security: 1. This! 2…
Yep, don't most of these work with conductivity? I just hacked something together using a paperclip and it works great.
A colleague has a chain made of paperclips dangling from the back of his screen. For auth just poke the chain, looks cool and works great.
Re: Pressing YubiKeys
#215> If you work in tech, you probably have a YubiKey That is a gross overstatement. As someone who works for a pre-IPO startup and been in the bay in various startups for a number of years, I'd hazard that only 5-10% of the engineers had YubiKey, let alone "work in tech". Whether or not we _should_ is another question.
As an software engineer in a bank (i'm gonna call that tech) my password has to be 8 characters and capital letters don't matter. I still use a Yubikey personally.
Re: Pressing YubiKeys
#216Earlier quoted context omitted.
I like the concept but the price is steep IMO. $90 for two actuators in the starter kit then $40 for each additional module. I wonder if one could design a similar solution without requiring a bridge. Although of course given the power consumption adding WiFi on the actuators might not be a great idea.
The cost appears to be higher to cover the development/systems cost for the app?
That may be the case but it doesn't change the fact that I can't think of a use for these that is worth $40. I think the value these would add to my life would be worth closer to $5/each.
Now, if they existed for $5 each, I would be all over it and buy 10
Re: Pressing YubiKeys
#217Earlier quoted context omitted.
Those backup keys defeat the entire purpose of 2FA and are like storing passwords in plain text. It only takes 1, maybe 2 of those codes for an attacker to add another security key to your account for future unlimited access. Supporting multiple keys is a better solution.
Supporting multiple keys is a good idea but it solves a different problem. People want peace of mind. Backup codes are not like passwords in at least two important ways: * The site picks them, not you, so they're random nonsense different for each code, rather than inevitably being password1234 and being the same on Instagram, Twitter and your bank account. * You don't need them usually, so there's no reason you'll h…
I think the parent’s point is that if you’re going to allow backup codes you might as well just add “second password” as a form of 2FA and enforce some basic complexity requirements.
Re: Pressing YubiKeys
#218Earlier quoted context omitted.
Yubikeys can perform many functions; the one in the article is an OTP which can be accidentally pasted into Slack.
Yes. But the main insecurity isn't accidental pastes, it's being phished. The company the author of this article works for needs to switch to U2F.
If the only phishing protection you find meaningful for 2FA tokens is domain matching then any extension-based password manager like Bitwarden will work with far less hassle than needing a physical token or your phone.
Re: Pressing YubiKeys
#219At work we use to use the old Yubi keys that were nice and long and had a good contact areas. Then they switched to the nanos and wouldn't reprogram the old ones (or even order the larger ones of the same generation, or let us pay for them ourselves). You can do the entire OTP entirely in software. Just be sure that the location you place the secret is encrypted: https://battlepenguin.com/tech/replacing-okta-verify-w…
Personally, I just use Keypass since it can do TOTP very easily. It's not the best 2FA since it stores the second factor alongside the passwords, but you could fix this by having two databases.
I don’t really care about this one too much because if you got a copy of my pw database and knew the password you have enough access to remove the 2FA on my stuff.
Like there is literally 0% chance I’m going to let myself get permanently locked out of my accounts if my keys and phone get stolen.
Re: Pressing YubiKeys
#220Earlier quoted context omitted.
Yes. But the main insecurity isn't accidental pastes, it's being phished. The company the author of this article works for needs to switch to U2F.
If the only phishing protection you find meaningful for 2FA tokens is domain matching then any extension-based password manager like Bitwarden will work with far less hassle than needing a physical token or your phone.
Just hope your password manager's password doesn't get phished.
> or your phone.
Using your phone for 2FA doesn't provide any phishing protection that I know of.
What realistic attacks is a non-U2F Yubikey protecting against that TOTP (Google Authenticator) won't protect against?