Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Yubikey

debugging.works

Post reply on HN
Print view View original

41–50 of 186 posts

Re: How to Yubikey

#41

Post by nulbyte »

cookiengineer wrote: post #32

The attack surface of yubikey vs a laptop you carry around is interesting. Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. Anybody using USB locks? If you are focussing on FIDO for password management, I am assuming you are protected against HID emulating devices, like a rubberducky or teensy flashed with some malware installing HID emula…

> Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen.

I think that largely misses the point of having such a key. I have one, and I'm well aware that if my laptop is stolen, so is that key. But the point of it is not to protect the laptop from the outside; that's why my drive is encrypted.

The point of that particular Yubikey is to secure passwords and authenticate to some websites, all of which requires either a PIN or more passwords, even after breaking the encryption of the drive itself.

Then there's the fact that, if you steal my laptop, you're probably looking to sell it for cash. That is to say, threat models matter. If your a journalist in a hostile country, maybe other steps should be taken. But most of us here on a site called Hacker News aren't under such threats, romantic as they may be.

Re: How to Yubikey

#42

Post by nulbyte »

p410n3 wrote: post #37
cookiengineer wrote: post #32

The attack surface of yubikey vs a laptop you carry around is interesting. Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. Anybody using USB locks? If you are focussing on FIDO for password management, I am assuming you are protected against HID emulating devices, like a rubberducky or teensy flashed with some malware installing HID emula…

That implies people leave it plugged in, which is not advisable. Also ignores the fact that these keys have certain phishing protections. 2fa will fail when you're on a cloned phishing page, so you can't enter your totp code in a fake site. I use mine ALONGSIDE a traditional encrypted pw manager

Some people do leave then in. The Nanos are designed for exactly this behavior.

Re: How to Yubikey

#44

Post by krisoft »

cookiengineer wrote: post #32

The attack surface of yubikey vs a laptop you carry around is interesting. Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. Anybody using USB locks? If you are focussing on FIDO for password management, I am assuming you are protected against HID emulating devices, like a rubberducky or teensy flashed with some malware installing HID emula…

> Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen.

Not in how I use it. I only connect my yubikey when I need it (rarely at that).

> right? Right?

Just generally don't do this. It comes of as unnecessarily aggressive. Instead you could say "Do use USB locks on your laptop, because ....". The "right? Right?" is not making your point more persuasive.

> Because if not then all that added layer of secure feelings is pointless from an operational security perspectiv

You are assuming all kind of things about the threat environment and the concerns the person has.

Re: How to Yubikey

#45

Post by ptman »

nextlevelwizard wrote: post #12

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

https://www.token2.com/shop/product/fido-bundle-2-x-fido2-us... ? or https://www.token2.com/shop/product/token2-t2f2-typec-fido2-... , but there's no 2x bundle.

Re: How to Yubikey

#46

Post by pydry »

cookiengineer wrote: post #32

The attack surface of yubikey vs a laptop you carry around is interesting. Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. Anybody using USB locks? If you are focussing on FIDO for password management, I am assuming you are protected against HID emulating devices, like a rubberducky or teensy flashed with some malware installing HID emula…

I had the same thought. HOTP or TOTP with a phone seem like a better bet for 2FA these days.

Re: How to Yubikey

#47

Post by goodoldneon »

donkeyd wrote: post #19
sverhagen wrote: post #15

Earlier quoted context omitted.

>a backup >convenience I always wonder how often someone gets into a crisis because their Yubikey breaks while they're at, say, a conference (ie. far away from the backup, be it another key, or access to recover codes). I recon they can just break when plugged into a laptop that takes a dive.

Most people have only their phones, which can also break. But some people only start thinking about that stuff when they look at alternatives like the Yubikey. > they can just break when plugged into a laptop that takes a dive So can the laptop at a conference. Or anything else really. I just remove my Yubikey after use and carry it in my wallet when not in use. Sure, I can lose my wallet, but I have multiple back-up…

YubiKeys are more fragile than phones. One time a drop of water got on my plugged-in YubiKey and it stopped working for 2 days

Re: How to Yubikey

#48

Post by doubled112 »

goodoldneon wrote: post #47
donkeyd wrote: post #19

Earlier quoted context omitted.

Most people have only their phones, which can also break. But some people only start thinking about that stuff when they look at alternatives like the Yubikey. > they can just break when plugged into a laptop that takes a dive So can the laptop at a conference. Or anything else really. I just remove my Yubikey after use and carry it in my wallet when not in use. Sure, I can lose my wallet, but I have multiple back-up…

YubiKeys are more fragile than phones. One time a drop of water got on my plugged-in YubiKey and it stopped working for 2 days

I don't understand this perspective.

I dropped my phone one time and could never unlock the screen again. It shattered into a dozen pieces.

I've dropped my YubiKey many times with no damage. It has no moving parts. No glass. No screen. A tiny OS. Not much to go wrong.

Re: How to Yubikey

#49

Post by ryokeken »

lakomen wrote: post #28

Your paranoia is getting out of hand, seriously. 2FA here, OTP there. Idk about you, maybe you do have such sensitive data that you have to double guard everything, I and the usual average guy doesn't. Why do I care? Because this craze has already reached the real world. Amazon requiring 2FA on deliveries. Wtf is wrong with my passport or other document? Nothing. Now I have to be physically present and recite some fu…

where does amazon requires 2fa for deliveries or be present for it? in nj/ny doesn't seem to happen

Re: How to Yubikey

#50

Post by vifon »

> I don’t see any use case or security benefits by using the static password feature. Even if you enter a password manually and concatenate it with the password of the Yubikey, a keylogger still gets both parts (assumption: You don’t reuse passwords).

If keylogger is what you're defending from, yes, it doesn't help. And in this scenario you've probably already lost.

On the other hand, it makes a large portion of the password immune to video-recording you typing the password in. Yes, it's technically trivial to then steal your Yubikey, extract the static password and combine it with the recorded one, but these are still quite some extra steps.

My point is, if a particular service or application doesn't support anything more refined, using a static password as a pepper[0] is perfectly fine and still an improvement over not doing so.

[0] https://en.wikipedia.org/wiki/Pepper_(cryptography)

Post reply on HN