Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting the most out of YubiKeys for your business

blog.congruentlabs.co

Post reply on HN
Print view View original

41–50 of 77 posts

Re: Getting the most out of YubiKeys for your business

#41

Post by pricechild »

tialaramex wrote: post #20
ykevinator wrote: post #8

Virtually every u2f implementation I've ever seen allows otp as a backup, reducing the security of one to the other. U2f is so much nicer than otp but hardware keys have devolved to being convenient not more secure than otp.

Just because you're allowed to do OTP backup doesn't require you to switch it on. If you have two FIDO keys that's fine. What isn't fine is one FIDO key and no other backup. The good ones aren't fragile, but you can still easily lose them. If there's a site you use on the phone too, newer Android devices which know how to keep a secret (e.g. a Pixel) can do WebAuthn for themselves and be that second option for you.

I think the point was that most u2f implementations around don't just allow OTP as backups... they require you to set up OTP first before u2f can be enabled.

It does make a bit of sense. Users can't be trusted not to lose their single token. But rarely is the option to enrol a second u2f key as backup permitted.

Re: Getting the most out of YubiKeys for your business

#42

Post by [deleted] »

techslave wrote: post #32
timothy-quinn wrote: post #21

Earlier quoted context omitted.

Hi! I'm actually the product manager for the product mentioned in that article: https://enterprise.signata.net . Are you heavily SaaS based for the tools you use in your startup, or do you have some on-prem infrastructure? That'll kind of dictate which path you should go down for provisioning the keys to your users. Our product will be perfect if you're using AD & a Microsoft CA internally (or are willing to set one…

did you not read the question? it’s 5 ppl and either outside IT or random joe employee 1-2 hrs per week. they are not managing AD and CA infrastructure.

[deleted]

Re: Getting the most out of YubiKeys for your business

#43

Post by philihp »

RcouF1uZ4gsC wrote: post #15
Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

I think the intuition is that it is supposed to be like a key. People generally do a pretty good job securing their keys. In addition, it is easy to have a backup key stored somewhere safe. One nice thing about Yubikey instead of phone, is that since it only does one thing, you are far less likely to need to upgrade it. In the past, I have lost a 2 factor on my phone when upgrading since it is not backed up.

It’s like a physical key, also inside a combination lockbox, hanging from your keychain. It follows the Unix Philosophy in this regard of doing one thing very well and I think that’s a large part of the appeal.

Granted it does many things well, I think the most common case with Yubikeys is we only use them for one or two of their possible functions, and they’re cheap enough that this is okay; like a screw driver with half a dozen bits in the handle, but I just use the Philihp’s Head bit. In earlier Yubikeys, they could get stuck in PIV mode (like getting a bit stuck in your screwdriver), but I doubt anyone ever noticed.

Re: Getting the most out of YubiKeys for your business

#44

Post by tialaramex »

pricechild wrote: post #41
tialaramex wrote: post #20

Earlier quoted context omitted.

Just because you're allowed to do OTP backup doesn't require you to switch it on. If you have two FIDO keys that's fine. What isn't fine is one FIDO key and no other backup. The good ones aren't fragile, but you can still easily lose them. If there's a site you use on the phone too, newer Android devices which know how to keep a secret (e.g. a Pixel) can do WebAuthn for themselves and be that second option for you.

I think the point was that most u2f implementations around don't just allow OTP as backups... they require you to set up OTP first before u2f can be enabled. It does make a bit of sense. Users can't be trusted not to lose their single token. But rarely is the option to enrol a second u2f key as backup permitted.

The only place I've used WebAuthn/ U2F that did not allow me to enrol multiple keys was AWS. I have two (or more) keys enrolled at Facebook, Google, GitHub, and for my government services.

WebAuthn (which is the one that's actually a documented standard) not only goes out of its way to make multiple tokens practical it explicitly calls out the intent that you should allow users to enrol multiple tokens.

Re: Getting the most out of YubiKeys for your business

#45

Post by tialaramex »

blattimwind wrote: post #38
Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

You can MITM OTP, but you can't MITM U2F. You can copy/steal the OTP secret from a phone app, but you can't copy/steal the U2F private key from a Yubikey (easily).

With Push MFA it's even easier, the sequence goes like this:

Crooks know Barry's password but Push MFA is needed to sign into his account and conduct some crime

Crooks somehow get Barry to go to a site they control believing it is for Work [there are a lot of ways to do this step, links in email, hijacking forgotten subdomains, typo squatting, the list goes on]

The site says "Hi Barry, we need to do Push MFA"

Crooks sign into Barry's real account with the password, causing a Push MFA to happen.

Barry was expecting Push MFA because the bogus site prompted saying it would happen so OKs it.

Crooks have now successfully passed the MFA

Re: Getting the most out of YubiKeys for your business

#46

Post by tialaramex »

Exmoor wrote: post #23
RcouF1uZ4gsC wrote: post #15

Earlier quoted context omitted.

I think the intuition is that it is supposed to be like a key. People generally do a pretty good job securing their keys. In addition, it is easy to have a backup key stored somewhere safe. One nice thing about Yubikey instead of phone, is that since it only does one thing, you are far less likely to need to upgrade it. In the past, I have lost a 2 factor on my phone when upgrading since it is not backed up.

That makes sense, and initially that is how I treated it, but essentially everyone I work with keeps theirs plugged in to their laptops 24/7. In fact, the keys we get as backups/replacements are the low profile ones designed to be plugged in and not removed without significant difficulty.

The effect this has is to make the laptop a "Something you have" factor. This works fine so long as the business is strict about ensuring people treat laptops appropriately and report losses quickly.

e.g. my last big corporate employer would sometimes randomly take any laptops that had not been properly physically secured during a meeting or over lunch. You'd come back and somebody groans "Oh no, we were only gone a few minutes". Yes we were, and you didn't bother locking your laptop so now you're going to have to grovel to somebody to get it back.

Re: Getting the most out of YubiKeys for your business

#47

Post by 0xCMP »

Something rarely mentioned with SSH, but which there have been a few recent articles on HN about, are SSH certificates and the fact that you can use the PIV of a yubikey to do certificate management.

e.g. You can create a certificate which you load the public key of in to your servers (using initial access or baked in to some image) which the private key is loaded in the PIV of the YubiKey. Someone can then generate an SSH keypair and provide you their public key and you can generate an SSH Cert which allows them access to that server for the time and specific users you specify in the certificate. It requires using OpenSSH instead of something like libSSH2 (which most iOS clients are using instead unfortunately).

This is all the same thing actually as running your own TLS CA by the way so you can also use a yubikey to securely store a sub-CA used to create certificates for internal use.

Re: Getting the most out of YubiKeys for your business

#48

Post by akerl_ »

0xCMP wrote: post #47

Something rarely mentioned with SSH, but which there have been a few recent articles on HN about, are SSH certificates and the fact that you can use the PIV of a yubikey to do certificate management. e.g. You can create a certificate which you load the public key of in to your servers (using initial access or baked in to some image) which the private key is loaded in the PIV of the YubiKey. Someone can then generate…

It’s worth noting that for “SSH certificates”, the leaf certs are not x509-based, and that you can’t put a CA-signed SSH user key onto a yubikey.

When yubikeys are used for SSH auth (either in GPG or PIV mode), they’re using the raw private key (either via GPG-agent or opensc, generally). The SSH client/server doesn’t get context about the identity, its trust relationships, etc.

This limits usage to trusting individual keys, rather than being able to trust “all keys signed by the CA”.

Re: Getting the most out of YubiKeys for your business

#49

Post by [deleted] »

closeparen wrote: post #29
toomuchtodo wrote: post #24

Earlier quoted context omitted.

If you can’t use a phone as a factor, it’s likely you’ll be issued a smart card (such as a CAC in the case of the military). It feels like Yubikeys are a shim until the phone UX as a factor improves (and there’s more server side support) and/or smart card adoption for identity improves. If Touch ID and Face ID are good enough for most secure transactions in the Apple ecosystem (including Apple Pay), seems like a reas…

Some of the U2F-only tokens are their own thing, but the flagship Yubikey is literally a smart card bundled with a reader. The USB token form factor makes a little more sense for an individually assigned laptop.

[deleted]

Re: Getting the most out of YubiKeys for your business

#50

Post by matheusmoreira »

jwr wrote: post #34

YubiKeys are absolutely fantastic, and under-rated, too. I used this guide: https://github.com/drduh/YubiKey-Guide to set up my YubiKeys with GPG keys that are also used as SSH keys. This gives me, in a single setup: * secure 2FA for sites with WebAuthN * ability to encrypt backups and other information using GPG, with decryption only possible with a physical device * ability to securely log in via SSH to all my infr…

I use my YubiKey to store a full set of subkeys while keeping my primary key offline on paper. No secret keys are ever written to disk. I boot a live Linux system and restore my primary key when I need to generate new subkeys or sign other people's keys.
Post reply on HN