Inside Yubikey Neo

#1

Post by tasqa » Fri, Oct 30, 2015, 4:50 PM UTC

Re: Inside Yubikey Neo

#2

Post by vessenes » Fri, Oct 30, 2015, 5:26 PM UTC

I like how polite Yubi and Hexview are in this exchange; a breath of fresh air from an infosec company engaging with a security company! Makes me feel like there are grown-ups both places, and that the work will help Yubi in future iterations.

Re: Inside Yubikey Neo

#3

Post by justhere4beer » Fri, Oct 30, 2015, 5:27 PM UTC

Hard to take your article seriously with statements such as "...Levels 1 and 2 of the FIPS140-2 certification are just a marketing gimmick". Even harder to believe Jakob took the time to respond.

Re: Inside Yubikey Neo

#4

Post by gruez » Fri, Oct 30, 2015, 5:37 PM UTC

justhere4beer wrote: post #3

Hard to take your article seriously with statements such as "...Levels 1 and 2 of the FIPS140-2 certification are just a marketing gimmick". Even harder to believe Jakob took the time to respond.

Hexview provided their reason for believing that. Care to explain why you think otherwise?

Re: Inside Yubikey Neo

#5

Post by Luc » Fri, Oct 30, 2015, 5:39 PM UTC

That's a lot of text to say nothing of interest. I really love how they question the trade offs made in the PCB design, as if these things didn't occur to the designers.

Re: Inside Yubikey Neo

#6

Post by niels_olson » Fri, Oct 30, 2015, 5:39 PM UTC

I accidentally ran over my Yubikey with my Honda Accord, on a key ring with a fin key (1). I dusted it off and it works fine 6 months later. Seriously, if you're in a position where you're using a Yubikey, getting another Yubikey isn't that big a deal for the organization. In fact, if you're a solo practitioner using something like Yubikey, I recommend you get another one and just keep it in a lock box in the event you, say, run over the primary with your car :)

(1) http://www.amazon.com/FCS-Moulded-Steel-Fin-Key/dp/B003JCQPX...

Re: Inside Yubikey Neo

#7

Post by spectralblu » Fri, Oct 30, 2015, 5:45 PM UTC

Luc wrote: post #5

That's a lot of text to say nothing of interest. I really love how they question the trade offs made in the PCB design, as if these things didn't occur to the designers.

Disappointed that they did nothing to probe the onboard MCUs to see if they could get it to leak anything, and just dismissed that with "we expect it to get high marks there." This seems an awfully low quality report from an infosec company. I was hoping to see an audit of the controllers onboard to see if (and if so, how much effort) they can extract onboard secrets, because after all that's the whole purpose of this device, to act as a secrets repository.

Re: Inside Yubikey Neo

#8

Post by dombili » Fri, Oct 30, 2015, 6:02 PM UTC

Off-topic, but I came across this tweet today.

https://twitter.com/flexlibris/status/660108123487789056

> TSA at Boston airport tried to take my Yubikeys away from me to a second location "for a test". I refused & they backed off but FYI people.

If you have your Yubikeys with you while traveling, you might want to be careful.

Re: Inside Yubikey Neo

#9

Post by ChuckMcM » Fri, Oct 30, 2015, 6:04 PM UTC

Nice article, would be interesting to build something that HexView did, in fact, find "nearly indestructible". Full disclosure I'm a fan of the Yubikey, I think that something like it will be the future of operational security for networks. Requiring the key be present to answer challenges helps a lot.

Re: Inside Yubikey Neo

#10

Post by jonknee » Fri, Oct 30, 2015, 6:09 PM UTC

Luc wrote: post #5

That's a lot of text to say nothing of interest. I really love how they question the trade offs made in the PCB design, as if these things didn't occur to the designers.

I found it interesting since as a user you can't see the PCB. Of course the designers knew about the tradeoffs, it's just nice to know what those tradeoffs were.