201–210 of 269 posts
Earlier quoted context omitted.
Having two keys, one of which you keep in a secure place, seems pretty simple and intuitive to me.
What does your workflow look like when you set up new credentials?
Earlier quoted context omitted.
I think Yubikey (and similar physical solutions) will eventually gain popularity. Carrying a key is pretty much a standard practice across the globe and benefit is more than negligible because it forces physical attack versus remote/virtual.
Until keys become cloneable they will never gain popularity. Nobody wants to re-setup every site ever because they lost their laptop that they kept it plugged into, so they won't. either this means using their backup until they lose it without even revoking the original and then swearing off the entire concept while telling all their friends to do the same, or just not using hardware tokens after the first lost of ke…
There are other solutions. Being able to make one key a proxy for another is one. That allows you to keep your master identity in a bank vault, and then use it to "sign" the one you keep on you during the day. Should you lose your daily driver, just sign another one. This still suffers from the "one true name" problem though - if someone steals that bank vault ID, you're gone.
Another approach is servers allowing a client to register multiple ID's, and later delete them. Since there are multiple ID's, there isn't one true name any more. If one is lost you cancel it, and replace it with another. The approach is already built into the FIDO2 protocol, so they've already thought about your concerns and solved them, and IMHO solved them in a better way than you propose.
A more robust approach still would be a combination of the idea above: FIDO2 multiple ID's solution, plus proxies. One key could then provide multiple ID's to every server you log into, signed by different masters that are stored in different places. Keys can't be copied, but a lost key can be replaced by signing it with the master. A compromised master can be have all it's ID's dropped by logging in with an ID proxying other master. You could think of it as RAID for 2FA's.
They author makes a few good points, but I find the author's critique of Yubikey weak: >Cost. The average YubiKey is £50... If that's too expensive for ensuring your internet security, then either you underestimate the risks, or undervalue your information. If a Yubikey cost 10 times more it would still be a bargain. >Usability. Buy a device, register it, install the app, configure it, find the setting in the website…
I mean, you say all this, but more or less these are the same complaints I hear from even seasoned IT professionals every single day when it comes to security. Even the "the key is in my coat" is not a joke at all -- I've had clients who got compromised by a malicious insider because some admin wrote passwords on a sticky note simply because "password managers are cumbersome". I get what you're saying on each point,…
Totally agree on that. The author's main ranting about Yubikey is that it requires developing new habits, but that's exactly the point.
>they're not promoting their value to sites in a way that implementation is a no-brainer.
That's a good point. Although, poor adoption of hardware tokens even by banks (e.g. no bank in Canada supports Yubikey) is surely not because it's hard to implement. It's a "chicken-or-egg" problem. Organizations don't support hardware tokens because few people use them, and few people use tokens because many organizations don't support them anyway. Yubikey and other hardware token vendors could've done a better job promoting and simplifying using hardware tokens.
Earlier quoted context omitted.
Can you give me an actual example of this with a google search right now?
I just did an ingonito search for "!g ETA", I got 3 results on the screen CanadianTravel - ETA Ad·www.canadaonlineapplication.org/ CanadianTravel - ETA Ad·www.canadatravelvisa.com/ CanadaETA - for UK citiziens - canadian-etavisas.com Ad·www.canadian-etavisas.com/ Which all look the same, and seem to charge $99 for the 'service' of filling in a form the Canadian government charges $7 for. After that there is a wikipag…
Earlier quoted context omitted.
> Some banks have a “word” or picture you select that they’ll show you durning login - never understood how this can’t just be proxied. It can, simple as that. Some make it moderately more difficult by showing you, say, 9 pictures and asking you to pick the one that's yours. But, again, dead easy to proxy.
The original version of this pattern relied on local storage on your device to ensure that only the real site or app could show you the right image.
For added protection, you can prompt the user to select which nonce is correct to force them to verify it is correct. The Microsoft authenticator does this sometimes.
The downside of this approach is that it requires a constant connection between the second factor the service. It also relies on the fact that the service authenticates itself via TLS or some other means, though that is a relatively minor issue.
Not sure why the author is so negative on Yubikey. His only reason is that an attacker can steal his laptop with the key plugged in. That’s a user error. I much rather have Yubikey over all other forms of security because it simply forces the attacker to be physically present. Why is that important? Because even if your laptop is stolen with your Yubikey at a local Starbucks, you’re more likely to catch that person v…
Author here. I did provide a few other reasons - mostly around usability of YubiKeys. Try observing a non-techie set one up and tell me if you think it is as easy as it could be. Realistically, you're probably not going to catch a mugger. Otherwise robberies like that wouldn't occur. Snatching a laptop with a key physically plugged in it is probably easier than snatching a laptop and a separate phone. Regardless of m…
Earlier quoted context omitted.
Price. Yubikey's "best seller" goes for $45, that's grotesque. I would be surprised if the hardware costs exceeds $2 per unit and the software (or similar) can be had for free.
It's not about the hardware. In spite of the fact that they can nominally be broken into, most modern USB microcontrollers can easily implement being a security key. The expense is that the security world hasn't converged on anything remotely approaching a single standard. So, a key has to support ... PGP, OpenSSH, FIDO, FIDO2, U2F ... For example, you couldn't use some of the older YubiKeys with AWS because AWS only…
Not sure why the author is so negative on Yubikey. His only reason is that an attacker can steal his laptop with the key plugged in. That’s a user error. I much rather have Yubikey over all other forms of security because it simply forces the attacker to be physically present. Why is that important? Because even if your laptop is stolen with your Yubikey at a local Starbucks, you’re more likely to catch that person v…
Author here. I did provide a few other reasons - mostly around usability of YubiKeys. Try observing a non-techie set one up and tell me if you think it is as easy as it could be. Realistically, you're probably not going to catch a mugger. Otherwise robberies like that wouldn't occur. Snatching a laptop with a key physically plugged in it is probably easier than snatching a laptop and a separate phone. Regardless of m…
Also, if a user can't learn how to operate a Yubikey after 10 minutes I don't think there is anything that can keep them safe online.
Earlier quoted context omitted.
What’s the second factor with yubikey? The site seems to say it’s passwordless.
A yubikey doesn't replace a password.