The fact that there are other ways to circumvent 2fa highly depends on companies practices. Using fake informations is a good start but even without fake infos I still am trying to regain access to the majority of my 2faed accounts since last December
The Yubikey Is the Digital Seatbelt We Need
51–60 of 73 posts
Re: The Yubikey Is the Digital Seatbelt We Need
#52Nope. It’s an add-on, but you can lose them. I am a bit flabbergasted that corporates are now handing them out like candy, but only one to a user. And if they lose them, they can’t even log in to request another.
Yeah I’m not super familiar with Yubikey but can’t you get a backup one you can hide away in case you lose your “main one”? I really don’t like single points of failure like what you are pointing out. I think my odds of losing my device are far higher than getting hacked with plain old TOTP or passkeys. All my financial sites have 2FA turned on or I would kick them to the curb.
Re: The Yubikey Is the Digital Seatbelt We Need
#53Earlier quoted context omitted.
I don't know which company you are talking about, but every company I've worked at always had a two Yubikey policy.
My large company certainly doesn't. Oh, don't get me wrong - I have two, but they're for accessing different resources! If I lose one, I lose access to those resources until I can get a new one shipped to me. Can't buy your own either - not that I'm complaining about that. Of course, since one of the keys protects access to resources that can only be accessed from a special laptop, it lives there, and is hard to lose…
You should probably bring it up. I guess they figure if you only use it with company accounts that IT can always fix it and get a new one to you. That would dissuade you from using it for personal accounts. Not my own opinion, just trying to figure out how the bean counters think.
Re: The Yubikey Is the Digital Seatbelt We Need
#54No, it's not. We need less shoddy practices to develop software, e.g. mandatory 4-eyes process for security-critical changes, thread modelling, and maybe more Hardware Security Modules that encrypt critical information. And if you need a second factor, I'm sure any smartphone-based TOTP will do. People already guard their smartphone well. No extra key fob needed.
You can get as many eyes as you want on all changes. I don't think it will help much. This sort of thing usually happens because of a change in something completely benign, rather than "security-critical changes". We recently had a pretty major vulnerability exposed by a PEN test (thankfully) that was caused by a single misplaced NOT ! operator in a pretty simple function, maybe 20loc with 100% test coverage as count…
> We should be putting less trust in software.
This is the conclusion I've come to as well. Nothing critical should be solely software dependent. Software will fail and critical systems should be able to function without it.
Re: The Yubikey Is the Digital Seatbelt We Need
#55Earlier quoted context omitted.
The banks used to hand out key response generation devices for that. No interface at all but the buttons. There even was a paper version where you scratched to get the key. Like, it was way better.
In the EU these hardware keyfobs are now forbidden for banking because they are considered less secure than app-based 2FA. The reason is that an app-based confirmation gives you the opportunity to review the transaction you are confirming; they can display "Are you sure you want to send 19.99 € to website.com with payment description 'subscription'?".
> In the EU these hardware keyfobs are now forbidden for banking [...] an app-based confirmation gives you the opportunity to review the transaction you are confirming;
I'm confused, that seems like it confuses two independent aspects:
1. Whether the TOTP code comes from a fob-device versus a phone-device.
2. Whether some interactive interface you're using gives you a chance to see/confirm what you're about to authorize or not.
A phone app can lie to you about the transaction you're about to authorize regardless of whether the TOTP code was transcribed from an external device, transcribed from another app on the same phone, or auto-filled by itself.
Re: The Yubikey Is the Digital Seatbelt We Need
#56Earlier quoted context omitted.
I have a yubikey. It's okay but I don't take it with me. When I'm out I use my phone with a MFA app, and would never tie my MFA to a hardware dongle that is likely not to be on my person when I need it.
> It's okay but I don't take it with me. Sounds like that is the problem? I have mine on my keyring. (and have a backup in a safe.) > would never tie my MFA to a hardware dongle that is likely not to be on my person when I need it. The solution is to have it with you.
The problem is that you need at least hardware tokens, one on you and one in a safe place as a backup. And I can't justify the cost of that.
Re: The Yubikey Is the Digital Seatbelt We Need
#57https://ninjalab.io/eucleak/ the timing lol
Extraction of the ECDSA secret key of Yubikey 5 series FIDO devices
Re: The Yubikey Is the Digital Seatbelt We Need
#58Earlier quoted context omitted.
> It's okay but I don't take it with me. Sounds like that is the problem? I have mine on my keyring. (and have a backup in a safe.) > would never tie my MFA to a hardware dongle that is likely not to be on my person when I need it. The solution is to have it with you.
The problem is that you need at least hardware tokens, one on you and one in a safe place as a backup. And I can't justify the cost of that.
I wasn't able to justify the potential cost of not having them.
Re: The Yubikey Is the Digital Seatbelt We Need
#59Related:
EUCLEAK Side-Channel Attack on the YubiKey 5 Series
Re: The Yubikey Is the Digital Seatbelt We Need
#60Related: EUCLEAK Side-Channel Attack on the YubiKey 5 Series https://news.ycombinator.com/item?id=41434500
the timing hurts