The Yubikey Is the Digital Seatbelt We Need
1–10 of 73 posts
Re: The Yubikey Is the Digital Seatbelt We Need
#2No, it's not. We need less shoddy practices to develop software, e.g. mandatory 4-eyes process for security-critical changes, thread modelling, and maybe more Hardware Security Modules that encrypt critical information.
And if you need a second factor, I'm sure any smartphone-based TOTP will do. People already guard their smartphone well. No extra key fob needed.
Re: The Yubikey Is the Digital Seatbelt We Need
#3No, it's not. We need less shoddy practices to develop software, e.g. mandatory 4-eyes process for security-critical changes, thread modelling, and maybe more Hardware Security Modules that encrypt critical information. And if you need a second factor, I'm sure any smartphone-based TOTP will do. People already guard their smartphone well. No extra key fob needed.
> People already guard their smartphone well.
Keychain too.
Something irks me about concentrating all access management on a device that people also use for tons of commercial, data slurping apps and games. Banks, national governments, shops; they all want me to use their app as 2F. To me it seems precisely the opposite: the phone is not a good place for this.
Re: The Yubikey Is the Digital Seatbelt We Need
#4[deleted]
Re: The Yubikey Is the Digital Seatbelt We Need
#5No, it's not. We need less shoddy practices to develop software, e.g. mandatory 4-eyes process for security-critical changes, thread modelling, and maybe more Hardware Security Modules that encrypt critical information. And if you need a second factor, I'm sure any smartphone-based TOTP will do. People already guard their smartphone well. No extra key fob needed.
> People already guard their smartphone well. Keychain too. Something irks me about concentrating all access management on a device that people also use for tons of commercial, data slurping apps and games. Banks, national governments, shops; they all want me to use their app as 2F. To me it seems precisely the opposite: the phone is not a good place for this.
Amen: TOTP should be on a device with a much much smaller attack surface and supply-chain vulnerabilities.
This was many years back, but I remember searching to see if there was some kind of hardened not-a-phone appliance, without much luck.
Re: The Yubikey Is the Digital Seatbelt We Need
#6Earlier quoted context omitted.
> People already guard their smartphone well. Keychain too. Something irks me about concentrating all access management on a device that people also use for tons of commercial, data slurping apps and games. Banks, national governments, shops; they all want me to use their app as 2F. To me it seems precisely the opposite: the phone is not a good place for this.
Amen: TOTP should be on a device with a much much smaller attack surface and supply-chain vulnerabilities. This was many years back, but I remember searching to see if there was some kind of hardened not-a-phone appliance, without much luck.
The banks used to hand out key response generation devices for that. No interface at all but the buttons. There even was a paper version where you scratched to get the key.
Like, it was way better.
Re: The Yubikey Is the Digital Seatbelt We Need
#7No, it's not. We need less shoddy practices to develop software, e.g. mandatory 4-eyes process for security-critical changes, thread modelling, and maybe more Hardware Security Modules that encrypt critical information. And if you need a second factor, I'm sure any smartphone-based TOTP will do. People already guard their smartphone well. No extra key fob needed.
> I'm sure any smartphone-based TOTP will do
No it won't. Like the article states, I also believe that phishing resistance is a critical property of 2FA systems. This is something that TOTP will never be able to provide.
We don't need Yubikey the brand, but we do need security keys (i.e. FIDO) as a concept.
Re: The Yubikey Is the Digital Seatbelt We Need
#8I did have one, it was something like 20 steps to get it setup - a bit of a pain.
Re: The Yubikey Is the Digital Seatbelt We Need
#9Earlier quoted context omitted.
Amen: TOTP should be on a device with a much much smaller attack surface and supply-chain vulnerabilities. This was many years back, but I remember searching to see if there was some kind of hardened not-a-phone appliance, without much luck.
The banks used to hand out key response generation devices for that. No interface at all but the buttons. There even was a paper version where you scratched to get the key. Like, it was way better.
In the EU these hardware keyfobs are now forbidden for banking because they are considered less secure than app-based 2FA. The reason is that an app-based confirmation gives you the opportunity to review the transaction you are confirming; they can display "Are you sure you want to send 19.99 € to website.com with payment description 'subscription'?".
Re: The Yubikey Is the Digital Seatbelt We Need
#10I prefer user side SSL certificates.