Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Yubikey Is the Digital Seatbelt We Need

zagaja.com

Post reply on HN
Print view View original

31–40 of 73 posts

Re: The Yubikey Is the Digital Seatbelt We Need

#31

Post by darkhorn »

nine_k wrote: post #24
darkhorn wrote: post #10

I prefer user side SSL certificates.

Does a client-side certificate have a button which you must physically press to confirm the action? It's very important that some things wound not happen automatically.

What do you mean? I think that you mean giving token/passwords to the browser. And by pressing the phisical button you ensure that you don't give it to another web site.

Cline side certificate works only for the given specific domain and it automatically recognizes you. I forgot the specifics but it only works for a specific domain. You cannot use it for another domain even if you want.

Re: The Yubikey Is the Digital Seatbelt We Need

#32

Post by krisoft »

jen729w wrote: post #11

Yubikey will never prevent your data from being leaked. They didn’t crack your password. But a random, unique password prevents further harm. They can’t get data from another site just because they hacked this one. Have random, unique passwords. Use a password manager. Done.

> Yubikey will never prevent your data from being leaked.

That depends on how your data is being leaked. Of course it does not stop the service provider from leaking your data (intentionally or unintentionally). It protects you from phishing attacks.

> Have random, unique passwords. Use a password manager.

Sure. These are still good practices even with a yubikey.

Re: The Yubikey Is the Digital Seatbelt We Need

#33

Post by nine_k »

nh2 wrote: post #27
kstenerud wrote: post #21

Earlier quoted context omitted.

Nope, because I was grandfathered into it when Google switched it on for everyone without saying anything. You can still access gmail and such; you just can't set up any more devices without having some kind of 2fa. Now I have a hardware key. I wouldn't dare keep rescue key codes (which can't be revoked) in my wallet.

Can't you just use them to revoke them?

You can't revoke them if the paper is in the wrong hands, and you don't have a normal access to your account. (Well, they are much like a password in this regard.)

It's just different risk profiles. Your biggest risk might be to drop your phone and lose all the 2FAs in a Google Auth app. Or your biggest risk might be losing your wallet to a thief or robber who is going to hijack your accounts.

Re: The Yubikey Is the Digital Seatbelt We Need

#34

Post by amne »

brnt wrote: post #3
v1ne wrote: post #2

No, it's not. We need less shoddy practices to develop software, e.g. mandatory 4-eyes process for security-critical changes, thread modelling, and maybe more Hardware Security Modules that encrypt critical information. And if you need a second factor, I'm sure any smartphone-based TOTP will do. People already guard their smartphone well. No extra key fob needed.

> People already guard their smartphone well. Keychain too. Something irks me about concentrating all access management on a device that people also use for tons of commercial, data slurping apps and games. Banks, national governments, shops; they all want me to use their app as 2F. To me it seems precisely the opposite: the phone is not a good place for this.

I can unlock and drive my car with my phone and the house has smart locks. What is this keychain you keep mentioning? I know the app but I don't think that's what you mean.

Re: The Yubikey Is the Digital Seatbelt We Need

#35

Post by jgalt212 »

coldblues wrote: post #30

Yubikeys are useless when someone can reset your password or 2FA using personally identifiable information that was just leaked. A lot of us who practice good security will be PWNED through large scale data leaks. Whenever I sign up, I sign up with fake information, and so should you. Most services will not KYC you, so just lie.

As someone who recently dropped his phone in salt water can attest, it was pretty easy to reset my access for 8 of 10 of my 2FA accounts.

Re: The Yubikey Is the Digital Seatbelt We Need

#37

Post by bootlooped »

nine_k wrote: post #33
nh2 wrote: post #27

Earlier quoted context omitted.

Can't you just use them to revoke them?

You can't revoke them if the paper is in the wrong hands, and you don't have a normal access to your account. (Well, they are much like a password in this regard.) It's just different risk profiles. Your biggest risk might be to drop your phone and lose all the 2FAs in a Google Auth app. Or your biggest risk might be losing your wallet to a thief or robber who is going to hijack your accounts.

I think the chances of the kind of person who steals your wallet also being able to leverage pilfered two-factor authentication codes to hijack your accounts is almost zero.

Re: The Yubikey Is the Digital Seatbelt We Need

#38

Post by nxobject »

An even better analogy would be food safety enforcement for large food processors: not wearing a seatbelt makes the author’s proposal seem like it’s about you, when it really is about well-needed criminal penalties for FooCoGotPwned Ops (where FooCoGotPwned isn’t in tech, health, or finance.) Otherwise, like listeria in your liverwurst, it’s only a matter of time until you get hacked.

The only current remedy is a class action lawsuit which will eventually give you a pittance after many years, and it’s pathetic.

Re: The Yubikey Is the Digital Seatbelt We Need

#39

Post by wepple »

donatj wrote: post #26
v1ne wrote: post #2

No, it's not. We need less shoddy practices to develop software, e.g. mandatory 4-eyes process for security-critical changes, thread modelling, and maybe more Hardware Security Modules that encrypt critical information. And if you need a second factor, I'm sure any smartphone-based TOTP will do. People already guard their smartphone well. No extra key fob needed.

You can get as many eyes as you want on all changes. I don't think it will help much. This sort of thing usually happens because of a change in something completely benign, rather than "security-critical changes". We recently had a pretty major vulnerability exposed by a PEN test (thankfully) that was caused by a single misplaced NOT ! operator in a pretty simple function, maybe 20loc with 100% test coverage as count…

Not a hot take at all, for anyone who has worked with securing code.

SWEs simply aren’t trained to deeply examine code and the side effects of it being pressured by skilled attackers.

2+ LGTMs reduces the change of a security issue making its way in, but no amount of expensive “more eyes” will eradicate bugs.

Re: The Yubikey Is the Digital Seatbelt We Need

#40

Post by wepple »

v1ne wrote: post #2

No, it's not. We need less shoddy practices to develop software, e.g. mandatory 4-eyes process for security-critical changes, thread modelling, and maybe more Hardware Security Modules that encrypt critical information. And if you need a second factor, I'm sure any smartphone-based TOTP will do. People already guard their smartphone well. No extra key fob needed.

TOTP is trivially phishable.

Code security is orthogonal to end-user authentication methods.

So, wrong on every count.

Post reply on HN