Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Yubikey Is the Digital Seatbelt We Need

zagaja.com

Post reply on HN
Print view View original

21–30 of 73 posts

Re: The Yubikey Is the Digital Seatbelt We Need

#21

Post by kstenerud »

nine_k wrote: post #19
kstenerud wrote: post #16

Earlier quoted context omitted.

... Until you drop your phone and it breaks. And now you can't set up a new phone because you need to tap the notification sent to your old (now broken) phone in order to set up your new phone. I've already had this happen, which is why I use hardware keys now, and a backup phone.

Do you mean, you don't print these rescue codes which every 2FA thing keeps nagging you about? You don't have a printout in your wallet, or in your folder with important papers? Not even as a secure not in your password manager?..

Nope, because I was grandfathered into it when Google switched it on for everyone without saying anything. You can still access gmail and such; you just can't set up any more devices without having some kind of 2fa.

Now I have a hardware key. I wouldn't dare keep rescue key codes (which can't be revoked) in my wallet.

Re: The Yubikey Is the Digital Seatbelt We Need

#22

Post by kseistrup »

AndyMcConachie wrote: post #12
fph wrote: post #9

Earlier quoted context omitted.

In the EU these hardware keyfobs are now forbidden for banking because they are considered less secure than app-based 2FA. The reason is that an app-based confirmation gives you the opportunity to review the transaction you are confirming; they can display "Are you sure you want to send 19.99 € to website.com with payment description 'subscription'?".

This is false. I use a hardware thingy that I put my Dutch bank card into that generates numbers for logins and purchases. I have the option of using an app or the hardware card reader. I use a one time generating password hardware keyfob to login to the Dutch Belastingdienst. They require it and I don't think there is an app I can use for this purpose.

I agree.

Danish banks, because they use the national MitID authorisation, accept MFA via app, code generator, or a chip device:

https://www.mitid.dk/en-gb/get-started-with-mitid/mitid-auth...

Re: The Yubikey Is the Digital Seatbelt We Need

#23

Post by whywhywhywhy »

v1ne wrote: post #2

No, it's not. We need less shoddy practices to develop software, e.g. mandatory 4-eyes process for security-critical changes, thread modelling, and maybe more Hardware Security Modules that encrypt critical information. And if you need a second factor, I'm sure any smartphone-based TOTP will do. People already guard their smartphone well. No extra key fob needed.

> People already guard their smartphone well

You guard it well, your carrier barely even tries to guard your number from being stolen. Once you have that you can get into Apple account SMS auth/iCloud passwords and keys.

Re: The Yubikey Is the Digital Seatbelt We Need

#25

Post by pushupentry1219 »

netcatgirl wrote: post #17
stuaxo wrote: post #8

I did have one, it was something like 20 steps to get it setup - a bit of a pain.

What exactly did you do that you needed 20 steps to setup a YubiKey??

Yeah if any service supports it - it's usually pretty seamless process to set it up.

Now maybe if you're talking about using it for SSH, then it gets slightly more tricky depending on your config. Then again, it's definitely under 10 steps to set that up as well.

Re: The Yubikey Is the Digital Seatbelt We Need

#26

Post by donatj »

v1ne wrote: post #2

No, it's not. We need less shoddy practices to develop software, e.g. mandatory 4-eyes process for security-critical changes, thread modelling, and maybe more Hardware Security Modules that encrypt critical information. And if you need a second factor, I'm sure any smartphone-based TOTP will do. People already guard their smartphone well. No extra key fob needed.

You can get as many eyes as you want on all changes. I don't think it will help much. This sort of thing usually happens because of a change in something completely benign, rather than "security-critical changes".

We recently had a pretty major vulnerability exposed by a PEN test (thankfully) that was caused by a single misplaced NOT ! operator in a pretty simple function, maybe 20loc with 100% test coverage as counted by line.

The problem case was untested because while tests touched 100% of lines, not all combinations of paths through the code were tested.

The code had been written by myself about a year ago, and reviewed by four seasoned developers, none of whom spotted the issue.

How many thousands of eyes are on OpenSSL and yet major world ending vulnerabilities still crop up?

This might be a hot take, but you can make the process as painful as you like but at the end of the day, building secure software is nigh impossible. We should be putting less trust in software.

Re: The Yubikey Is the Digital Seatbelt We Need

#27

Post by nh2 »

kstenerud wrote: post #21
nine_k wrote: post #19

Earlier quoted context omitted.

Do you mean, you don't print these rescue codes which every 2FA thing keeps nagging you about? You don't have a printout in your wallet, or in your folder with important papers? Not even as a secure not in your password manager?..

Nope, because I was grandfathered into it when Google switched it on for everyone without saying anything. You can still access gmail and such; you just can't set up any more devices without having some kind of 2fa. Now I have a hardware key. I wouldn't dare keep rescue key codes (which can't be revoked) in my wallet.

Can't you just use them to revoke them?

Re: The Yubikey Is the Digital Seatbelt We Need

#28

Post by krisoft »

Delphiza wrote: post #14
v1ne wrote: post #2

No, it's not. We need less shoddy practices to develop software, e.g. mandatory 4-eyes process for security-critical changes, thread modelling, and maybe more Hardware Security Modules that encrypt critical information. And if you need a second factor, I'm sure any smartphone-based TOTP will do. People already guard their smartphone well. No extra key fob needed.

I have a yubikey. It's okay but I don't take it with me. When I'm out I use my phone with a MFA app, and would never tie my MFA to a hardware dongle that is likely not to be on my person when I need it.

> It's okay but I don't take it with me.

Sounds like that is the problem? I have mine on my keyring. (and have a backup in a safe.)

> would never tie my MFA to a hardware dongle that is likely not to be on my person when I need it.

The solution is to have it with you.

Re: The Yubikey Is the Digital Seatbelt We Need

#29

Post by tallanvor »

alsodumb wrote: post #20
rcarmo wrote: post #15

Nope. It’s an add-on, but you can lose them. I am a bit flabbergasted that corporates are now handing them out like candy, but only one to a user. And if they lose them, they can’t even log in to request another.

I don't know which company you are talking about, but every company I've worked at always had a two Yubikey policy.

My large company certainly doesn't. Oh, don't get me wrong - I have two, but they're for accessing different resources! If I lose one, I lose access to those resources until I can get a new one shipped to me. Can't buy your own either - not that I'm complaining about that.

Of course, since one of the keys protects access to resources that can only be accessed from a special laptop, it lives there, and is hard to lose, although that may also reduce security since it means the laptop and key are always together.

Re: The Yubikey Is the Digital Seatbelt We Need

#30

Post by coldblues »

Yubikeys are useless when someone can reset your password or 2FA using personally identifiable information that was just leaked. A lot of us who practice good security will be PWNED through large scale data leaks. Whenever I sign up, I sign up with fake information, and so should you. Most services will not KYC you, so just lie.
Post reply on HN