221–230 of 241 posts
Earlier quoted context omitted.
Google and Amazon are both well known to use hardware that is similar to a Yubikey, but not exactly the same.
I previously worked at AWS. I definitely used a company issued actual YubiKey while there.
If only people were allowed to bring their own Yubikey for U2F and OTP, then they wouldn’t have to wait on whatever official procurement processes are in place from their approved suppliers.
To access my account with the former an attacker needs my phone and me to log in to it for them.
To access my account with the latter an attacker just needs to hardware key.
I usually have my phone on me whereas I don't want to have to keep track of a tiny USB device and am likely to just leave it plugged into my laptop. My laptop is the most valuable item in my home and so most likely to be stolen, along with the attached key.
Surely an authenticator app like Authy is more secure than a hardware key like Yubikey. To access my account with the former an attacker needs my phone and me to log in to it for them. To access my account with the latter an attacker just needs to hardware key. I usually have my phone on me whereas I don't want to have to keep track of a tiny USB device and am likely to just leave it plugged into my laptop. My laptop…
Bam, someone now have the ability to authenticate as you without even needing physical contact and without you ever noticing - this could run for years without any trace. With yubikey you will notice that it is missing.
There is a yubikey with fingerprint sensor that is supposed to come soon as well.
In my case, the biggest case against a phone app is that the most likely disruption would be either that my phone was stolen (though not specifically to get my credentials) or just break from a fall or something.
And until there is a decent fallback from that passwords are the better choice for me. (Yubikeys aren't that much better in that regard either)
Earlier quoted context omitted.
I've never had a YubiKey, but lots of other places use smart cards (ISO 7816) for secure authentication. I suspect they are far more common than YubiKeys or newer tech, especially in the financial industries.
YubiKeys can pretend to be PIV of OpenPGP smartcard ;=) But yes in e.g. banking the security systems had been created long before there where really good USB based security keys so it's probably most times actual smartcards. But then it also turned out that many smartcatd drivers are just REALY bad and complex potentially making your system more vulnerable so I can totally see companies switching away from them.
I would link to a feature matrix, but Yubico makes it impossible to find one (although I know it exists).
Edit: found one https://www.yubico.com/products/compare-products-series/
> If you work in tech, you probably have a YubiKey That is a gross overstatement. As someone who works for a pre-IPO startup and been in the bay in various startups for a number of years, I'd hazard that only 5-10% of the engineers had YubiKey, let alone "work in tech". Whether or not we _should_ is another question.
As an software engineer in a bank (i'm gonna call that tech) my password has to be 8 characters and capital letters don't matter. I still use a Yubikey personally.
Earlier quoted context omitted.
As an software engineer in a bank (i'm gonna call that tech) my password has to be 8 characters and capital letters don't matter. I still use a Yubikey personally.
How do you have case-insensitive passwords? Does it all get smooshed to lowercase before it's salted and hashed?