Getting the most out of YubiKeys for your business

Post by barryp » Thu, Jun 18, 2020, 6:04 PM UTC

tialaramex wrote: post #45

blattimwind wrote: post #38

Earlier quoted context omitted.

You can MITM OTP, but you can't MITM U2F. You can copy/steal the OTP secret from a phone app, but you can't copy/steal the U2F private key from a Yubikey (easily).

With Push MFA it's even easier, the sequence goes like this: Crooks know Barry's password but Push MFA is needed to sign into his account and conduct some crime Crooks somehow get Barry to go to a site they control believing it is for Work [there are a lot of ways to do this step, links in email, hijacking forgotten subdomains, typo squatting, the list goes on] The site says "Hi Barry, we need to do Push MFA" Crooks…

Post by RcouF1uZ4gsC » Thu, Jun 18, 2020, 6:20 PM UTC

tialaramex wrote: post #46

Exmoor wrote: post #23

Earlier quoted context omitted.

That makes sense, and initially that is how I treated it, but essentially everyone I work with keeps theirs plugged in to their laptops 24/7. In fact, the keys we get as backups/replacements are the low profile ones designed to be plugged in and not removed without significant difficulty.

The effect this has is to make the laptop a "Something you have" factor. This works fine so long as the business is strict about ensuring people treat laptops appropriately and report losses quickly. e.g. my last big corporate employer would sometimes randomly take any laptops that had not been properly physically secured during a meeting or over lunch. You'd come back and somebody groans "Oh no, we were only gone a…

Post by teambayleaf » Fri, Jun 19, 2020, 10:57 AM UTC

ykevinator wrote: post #8

Virtually every u2f implementation I've ever seen allows otp as a backup, reducing the security of one to the other. U2f is so much nicer than otp but hardware keys have devolved to being convenient not more secure than otp.

Post by fullstop » Tue, Jun 23, 2020, 3:09 PM UTC

smichel17 wrote: post #59

fullstop wrote: post #54

Earlier quoted context omitted.

I want to get some sort of retractable lead for mine. My keys are heavy-ish and sometimes it can be difficult to get the key in a usb port without tension.

When I had more keys on my keyring I used something like this https://www.amazon.com/Lucky-Line-Keychain-Nickel-Plated-707... (not this particular one, which is just the top result that looked similar). It worked pretty well for a single key, but if you want to use more than one it adds a lot of extra bulk so your keychain gets even bigger. I also tried something like this https://www.amazon.com/Spider-Accessory-Spli…