31–40 of 66 posts
Alternate title: guide to changing your single factor authentication from "something you know" to "something you have."
I think you mean from "something you can forget" to "something you can lose"
True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. But stealing both is difficult and far more obvious. To login to my work VPN, the password is " ". Our SSO system requires both once per day as well. It's a great system and I highly recommend it.
I like that set up, even though that’s a password manager and not like an ssh key held on Yubikey.
True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. But stealing both is difficult and far more obvious. To login to my work VPN, the password is " ". Our SSO system requires both once per day as well. It's a great system and I highly recommend it.
This is a complete aside, but last year I purchased a keychain YubiKey 5, that supported USB-C and Lightning. I attached it to my key ring, and within about 8 weeks, the device was destroyed through the general wear and tear of being in my pocket. The plastic started chipping at one end of the device, and before the long the entire plastic shell shattered off completely exposing the board underneath. Was a pretty big…
Hmm, maybe that is particular to that model? I've only had Yubikeys that are regular USB sized, carry them around on keychains all the time dangling from a bag, but haven't had a problem in the years I've owned it. Generally they are considered pretty durable I thought. (But also wouldn't mine hearing recommendations for others for the future.)
Earlier quoted context omitted.
"Something you have" is generally an improvement over "something you know" for most people's account security. You have to remember where we are starting from - most people are still using the same password across all their accounts.
How is that? Everybody living in my house can get my Yubikey yet doesn't know my password. If I get robbed, my bank account is still (relatively) safe.
There are a lot more people far away from you than there are close to you. If breaking your security requires physical proximity (such as to steal a yubikey), then you are much safer just based on this. It's also easier for people to blindly steal credentials for millions of people online than it is for them to steal millions of physical security keys.
Alternatively, passwords are commonly reused across websites, so a failure of any of those websites can lead to a compromise of all of them, which is not the case with a YubiKey. Along that same line of thought, passwords are phishable, where YubiKeys are not.
It's also possible that people in your physical proximity could shoulder surf your password, install a keylogger (which could be a physical keylogger, if you normally use a USB keyboard, not just software), or use a strategically positioned camera to do some digital shoulder surfing. Passwords aren't immune to trust issues when it comes to physical proximity. Ideally, you trust those you are near to some extent.
YubiKey also has a fingerprint-protected device coming out soon[0]... which would raise the bar for the threat model in this discussion some. Using a fingerprint and/or PIN to unlock a YubiKey preserves most of the benefits, while eliminating most of the concerns that people are mentioning. HSMs can choose to self-erase after a certain number of failed PIN attempts, so even a short PIN is not something that can easily be brute forced without an unpatched vulnerability.
If websites would allow you to only use any one of your YubiKeys to authenticate (obviously meaning you can have multiple, with backup YubiKeys stored somewhere safe in case you lose your main one), I think that would be a significant improvement in security over password authentication for most people. This is basically what the WebAuthn standard is attempting to do. I don't expect most people to be interested in buying 3 security keys and carrying one around all the time, though.
[0]: https://www.yubico.com/blog/yubico-reveals-first-biometric-y...
You can use the "yubikey personalization tool" to change the format of the yubico otp that it emits, including appending a enter key. This is the way you'd want it set up for that, with the "tab"s unselected and the "enter" selected: https://cdn.zappy.app/791c95f1c203ef39fb71ea2809aa82a6.png
99.7% of people will get their password stolen because they use only one on each service. It will get stolen on some shady site, and then checked against the same email on gmail.com.
The remaining 0.3% of the users will have their laptop stolen, together with the key. The thief will the re-image the laptop to sell it and throw the key away.
Finally, 1723 geeks in the world need to make sure they use 8 FA so they will be fine.
There are also enterprise users (35.8%) who will get something from their company which marry a PIN to an OTP and they will be fine.
In other words: yay yubikey! instead of password.
Note: the percentages not only are invented but do not add up to 100%. The first one is probably very, very underestimated.
True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. But stealing both is difficult and far more obvious. To login to my work VPN, the password is " ". Our SSO system requires both once per day as well. It's a great system and I highly recommend it.
How does that password scheme even work unless the plaintext pin is being stored somewhere?
True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. But stealing both is difficult and far more obvious. To login to my work VPN, the password is " ". Our SSO system requires both once per day as well. It's a great system and I highly recommend it.
I believe there‘s a new biometric yubikey in the works. A fingerprint version of the 5C NFC would be cool.
True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. But stealing both is difficult and far more obvious. To login to my work VPN, the password is " ". Our SSO system requires both once per day as well. It's a great system and I highly recommend it.
