Getting the most out of YubiKeys for your business • Hacker News Board

Re: Getting the most out of YubiKeys for your business

#11

Post by timothy-quinn » Thu, Jun 18, 2020, 2:06 AM UTC

m0zg wrote: post #10

Why is there so little competition for these? $50 for a key that maybe costs $5 to manufacture (yes, including software development, at their volume) is a little too rich for my blood.

Yeah Nitrokeys are probably the closest device, but cost even more https://www.nitrokey.com/

And usually it's twice what they charge, because you need a backup device to handle losing the first one.

I'd like to see a competitor come out with a combo PIV card & FIDO device. At least from the enterprise perspective it would cover 99.9% of MFA situations. And the majority of my personal uses of YubiKeys.

Re: Getting the most out of YubiKeys for your business

#12

Post by kevan » Thu, Jun 18, 2020, 2:26 AM UTC

timothy-quinn wrote: post #2

Does anyone use YubiKeys on OSX for business use? I've tried integrating them on my personal mac before, but the U2F PAM experience was pretty clunky, and caused weird messages from services like Keychain that (I guess) couldn't decrypt without normal credentials being provided at logon.

Yes, I use one daily and haven't had any issues.

Re: Getting the most out of YubiKeys for your business

#13

Post by Exmoor » Thu, Jun 18, 2020, 2:30 AM UTC

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a piece of hardware, but its one I'm vastly more likely to lose or misplace and doesn't require any verification that whoever is activating it is who they say they are. Is there something I'm missing?

Re: Getting the most out of YubiKeys for your business

#14

Post by timothy-quinn » Thu, Jun 18, 2020, 2:35 AM UTC

Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

It depends on the context really - I love the push-driven MFA products, but they specifically require you as a user to be carrying a phone with you at all times, and are usually considered "low" assurance of the user's identity.

If your business is seeking "higher" assurance (yes, assurance levels are very subjective) then certificate-based MFA can meet the needs better. Or, if your business is working with sensitive data/systems, phones may be banned from the office (e.g. military, intelligence, banks, etc.).

Re: Getting the most out of YubiKeys for your business

#15

Post by RcouF1uZ4gsC » Thu, Jun 18, 2020, 2:52 AM UTC

Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

I think the intuition is that it is supposed to be like a key. People generally do a pretty good job securing their keys. In addition, it is easy to have a backup key stored somewhere safe.

One nice thing about Yubikey instead of phone, is that since it only does one thing, you are far less likely to need to upgrade it. In the past, I have lost a 2 factor on my phone when upgrading since it is not backed up.

Re: Getting the most out of YubiKeys for your business

#16

Post by ses1984 » Thu, Jun 18, 2020, 2:58 AM UTC

Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

You should have to enter a pin to unlock the yubikey and if you fail so many times it can be locked forever.

Re: Getting the most out of YubiKeys for your business

#17

Post by burrben » Thu, Jun 18, 2020, 3:08 AM UTC

ses1984 wrote: post #16

Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

You should have to enter a pin to unlock the yubikey and if you fail so many times it can be locked forever.

If you are using the PIV applet of the Yubikey, then yes, a PIN is required. Failing the specified number of retries will result in the device being locked. The PIN can be unlocked with a PUK. Failing the specified number of retries with the PUK will brick the PIV applet. You can reset the PIV applet but all previous data will have been wiped.

Re: Getting the most out of YubiKeys for your business

#18

Post by brians » Thu, Jun 18, 2020, 3:14 AM UTC

m0zg wrote: post #10

Why is there so little competition for these? $50 for a key that maybe costs $5 to manufacture (yes, including software development, at their volume) is a little too rich for my blood.

Assurance that you’re getting the right $5 device is tricky—when the factory has so many incentives to do otherwise.

Re: Getting the most out of YubiKeys for your business

#19

Post by bsder » Thu, Jun 18, 2020, 3:26 AM UTC

I feel like a broken record, but:

If I have a startup of 5 people, how do I deploy 3 Yubikeys per person? How do I issue a new Yubikey to a person and connect it into systems if one of the old ones gets stolen? How do I disable a stolen Yubikey or all the Yubikeys if that person quits?

And how do I do this when the IT department is one person a couple hours a week?

Re: Getting the most out of YubiKeys for your business

#20

Post by tialaramex » Thu, Jun 18, 2020, 3:31 AM UTC

ykevinator wrote: post #8

Virtually every u2f implementation I've ever seen allows otp as a backup, reducing the security of one to the other. U2f is so much nicer than otp but hardware keys have devolved to being convenient not more secure than otp.

Just because you're allowed to do OTP backup doesn't require you to switch it on. If you have two FIDO keys that's fine.

What isn't fine is one FIDO key and no other backup. The good ones aren't fragile, but you can still easily lose them.

If there's a site you use on the phone too, newer Android devices which know how to keep a secret (e.g. a Pixel) can do WebAuthn for themselves and be that second option for you.