31–40 of 186 posts
Reminder: Yubico doesn't have a monopoly on security keys. Make sure your software/tutorials support the open-source alternatives like OnlyKey and NitroKey.
Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen.
Anybody using USB locks? If you are focussing on FIDO for password management, I am assuming you are protected against HID emulating devices, like a rubberducky or teensy flashed with some malware installing HID emulator.
And you do use USB locks on your laptop, right? Right? Because if not then all that added layer of secure feelings is pointless from an operational security perspective, other than preventing shoulder surfing. And if you are using a FIDO key, you usually have to enter a password to use it anyways, so it does not really protect against that either.
You could've just used a password manager with a LUKS encrypted system and you have the identical attack surface from an operational perspective.
The attack surface of yubikey vs a laptop you carry around is interesting. Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. Anybody using USB locks? If you are focussing on FIDO for password management, I am assuming you are protected against HID emulating devices, like a rubberducky or teensy flashed with some malware installing HID emula…
My large USB A Yubikey is in my pocket, with my keys. So unless someone is mugging me or also stealing my pants, nope.
Your paranoia is getting out of hand, seriously. 2FA here, OTP there. Idk about you, maybe you do have such sensitive data that you have to double guard everything, I and the usual average guy doesn't. Why do I care? Because this craze has already reached the real world. Amazon requiring 2FA on deliveries. Wtf is wrong with my passport or other document? Nothing. Now I have to be physically present and recite some fu…
The good thing is, the launcher app on _my_ PC got the feature (a few years ago) that I only need to use the actual 2FA fob once every few months, not every time I login. It protects me against the most common case (someone logging in with my account/stealing my account) while not getting in the way at all. Unless someone breaks into the apartment, but I'll take that risk.
Still wondering what's wrong with most orgs not even offering the user the choice of "no 2fa/2fa everytime/whitelist this one device for $period".
I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.
Also I have my passwords synced to my phone, which could serve as a mobile backup in a pinch. I currently have it configured to require the key, but I should probably change that now that I think about the possibility of losing the key.
Using the key is more convenient to me than not using it, because it saves me from having to remember and enter a long master password.
The attack surface of yubikey vs a laptop you carry around is interesting. Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. Anybody using USB locks? If you are focussing on FIDO for password management, I am assuming you are protected against HID emulating devices, like a rubberducky or teensy flashed with some malware installing HID emula…
Reminder: Yubico doesn't have a monopoly on security keys. Make sure your software/tutorials support the open-source alternatives like OnlyKey and NitroKey.
Safari seems to have its own implementation of a virtual security key also. Before I plugged in my Yubico recently, Safari asked me for my fingerprint as a fallback.
[0] https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...
The attack surface of yubikey vs a laptop you carry around is interesting. Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. Anybody using USB locks? If you are focussing on FIDO for password management, I am assuming you are protected against HID emulating devices, like a rubberducky or teensy flashed with some malware installing HID emula…
Reminder: Yubico doesn't have a monopoly on security keys. Make sure your software/tutorials support the open-source alternatives like OnlyKey and NitroKey.
or SoloKey
But there are indeed alternatives to yubikey. Anyone have experience with https://www.token2.com/shop/product/token2-t2f2-fido2-and-u2... ? 128 resident keys is much better than 25/50