Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pressing YubiKeys

bert.org

Post reply on HN
Print view View original

231–240 of 241 posts

Re: Pressing YubiKeys

#231

Post by diroussel »

hrishios wrote: post #229
delusional wrote: post #215

Earlier quoted context omitted.

As an software engineer in a bank (i'm gonna call that tech) my password has to be 8 characters and capital letters don't matter. I still use a Yubikey personally.

How do you have case-insensitive passwords? Does it all get smooshed to lowercase before it's salted and hashed?

I think he means the password complexity policy is only measuring length, and doesn’t distinguish between upper and lower case. Not that the case doesn’t matter in the password. Just in the policy.

Re: Pressing YubiKeys

#232

Post by bsoft16385 »

dzhiurgis wrote: post #118

Google won’t let you setup 2FA without adding a phone number which kind of sets you up for sun swapping attack by design... My biggest beef is lack of NFC in MacBook. I wan’t a key in card factor because who the hell has keys these days. Maybe add hardware button on the card. It would work on on mobile and laptops. Banks could use their own credit cards for logging in...

If you sign up for the Advanced Protection Program, Google will allow you to use a security key without allowing SMS recovery.

Re: Pressing YubiKeys

#233

Post by homakov »

No, no one should own a yubikey.

It's an entirely useless device. All you need is a pw manager that saves you from non-malware attacks (email compromise aside). Yubikey cannot save you from persistent malware, which makes it useless in almost all scenarios. The only hardware device that makes sense is the one with a screen (like trezor). Simple click-to-use devices carry no protections that you wouldn't otherwise get with a pw manager.

Re: Pressing YubiKeys

#234

Post by 8note »

bradknowles wrote: post #222
glenngillen wrote: post #221

Earlier quoted context omitted.

I previously worked at AWS. I definitely used a company issued actual YubiKey while there.

Amazon may use keys from a variety of sources, but the ones I’ve seen were packaged differently from anything I’ve seen from an actual Yubikey. If only people were allowed to bring their own Yubikey for U2F and OTP, then they wouldn’t have to wait on whatever official procurement processes are in place from their approved suppliers.

I've got a couple branded ones from amazon IT -- a big one and a tiny one. Currently they're giving out some other one, but I think you can bring your own too

Re: Pressing YubiKeys

#235

Post by tialaramex »

djur wrote: post #201
geocar wrote: post #186

Earlier quoted context omitted.

> Security isn’t binary. I hate that people say that. By adding some security (protecting against some threat) to another security (protecting against same threat) you gain no security, after all: 1+1=1 in binary, so security is binary in this way as well. By protecting the same thing with two different security mechanisms, you have multiplication, and in binary 1×0=0 so security is binary in this way. And so on. Sec…

My YubiKey requires me to enter a PIN as well, which expires after a period of time. I don't see any significant benefit to requiring a tap after I've entered the PIN.

The PIN can be entered remotely, or indeed supplied by software independent of a human's presence. The tap, on the other hand, cannot be synthesised without a bunch of extra malarkey.

If your Yubikey had a PIN terminal, it could treat the entry on its own PIN terminal as presence indication, but it just discerns the PIN via CTAP from the host computer and that might be caused remotely.

Re: Pressing YubiKeys

#236

Post by tialaramex »

cja wrote: post #223

Surely an authenticator app like Authy is more secure than a hardware key like Yubikey. To access my account with the former an attacker needs my phone and me to log in to it for them. To access my account with the latter an attacker just needs to hardware key. I usually have my phone on me whereas I don't want to have to keep track of a tiny USB device and am likely to just leave it plugged into my laptop. My laptop…

> Surely an authenticator app like Authy is more secure than a hardware key like Yubikey.

It is difficult to assess one choices as "more" or "less" secure without a threat model.

You've focused on the threat from attackers willing to use a mixture of a physical attack (stealing the phone or laptop, perhaps mugging you for it) and a digital attack (accessing online accounts using credentials they stole) but those are very rare.

On the other hand Phishing and other purely online attacks are extremely common. I probably see two or three attempts per week. Most of them are crude but not all, and they work.

Authy emits TOTP codes, so those can be phished. The phishing site gets you to enter your TOTP code, which it passes over to the genuine site, signing in the attacker with your 100% authentic working codes.

But a Yubikey (and dozens of cheaper alternatives including Yubico's own Security Key) can also be used with WebAuthn, which cannot be phished.

Re: Pressing YubiKeys

#237

Post by psanford »

tjoff wrote: post #224
cja wrote: post #223

Surely an authenticator app like Authy is more secure than a hardware key like Yubikey. To access my account with the former an attacker needs my phone and me to log in to it for them. To access my account with the latter an attacker just needs to hardware key. I usually have my phone on me whereas I don't want to have to keep track of a tiny USB device and am likely to just leave it plugged into my laptop. My laptop…

Depends... Your phone runs millions of lines of code and you likely browse the web on it which means that any moment an exploit could take over your phone. (or the regularly scheduled bluetooth vulnerabilities). Bam, someone now have the ability to authenticate as you without even needing physical contact and without you ever noticing - this could run for years without any trace. With yubikey you will notice that it…

> There is a yubikey with fingerprint sensor that is supposed to come soon as well

It was announced 11 months ago with no status updates since then. Its really not clear that this product will ever get released.

Re: Pressing YubiKeys

#238

Post by zrobotics »

diroussel wrote: post #231
hrishios wrote: post #229

Earlier quoted context omitted.

How do you have case-insensitive passwords? Does it all get smooshed to lowercase before it's salted and hashed?

I think he means the password complexity policy is only measuring length, and doesn’t distinguish between upper and lower case. Not that the case doesn’t matter in the password. Just in the policy.

Don't know about employee passwords, but for Wells Fargo the online login passwords are case insensitive. I assume this is due to some legacy system somewhere, but for their system password = PASSWORD = PaSsWoRd. One of the many reasons I no longer bank with them.

Re: Pressing YubiKeys

#239

Post by Cerium »

Thorrez wrote: post #182
Cerium wrote: post #25

A little off topic: Does anyone know of a way to get the results of a yubikey press into a remote desktop session? I frequently remote desktop into laptops that are in arms reach. If I need to use the yubikey, I have to remove it and plug it into my desktop and press it, since it acts as a local keyboard.

Wouldn't a local keyboard type into a remote desktop session? If a local keyboard can't type into a remote desktop session, the remote desktop session sounds mostly useless.

The local keyboard attached to the remote computer.

Re: Pressing YubiKeys

#240

Post by cja »

tialaramex wrote: post #236
cja wrote: post #223

Surely an authenticator app like Authy is more secure than a hardware key like Yubikey. To access my account with the former an attacker needs my phone and me to log in to it for them. To access my account with the latter an attacker just needs to hardware key. I usually have my phone on me whereas I don't want to have to keep track of a tiny USB device and am likely to just leave it plugged into my laptop. My laptop…

> Surely an authenticator app like Authy is more secure than a hardware key like Yubikey. It is difficult to assess one choices as "more" or "less" secure without a threat model. You've focused on the threat from attackers willing to use a mixture of a physical attack (stealing the phone or laptop, perhaps mugging you for it) and a digital attack (accessing online accounts using credentials they stole) but those are…

I'd like 3FA(!), which would be password plus OTP (e.g. a code from Authy) plus a hardware key like Yubikey. Wouldn't increase the work for me to log in since the Yubikey would always be in my laptop, but would avoid the phishing problem.
Post reply on HN