Jump in the discussion.

No email address required.

What is a yubikey

Jump in the discussion.

No email address required.

It's a physical USB device that has a secret cryptographic key on it.

You add this key to various accounts that you make and they will require the physical device to be present while you log-in.

I got two a year to secure my most important accounts (Apple, Google, etc.) and this exploit means an attacker can steal them and make copies of them - that's the worst thing that could happen to them minus a "remote" attack or something.

Jump in the discussion.

No email address required.

Still better than SMS 2FA tbqhwyf

Jump in the discussion.

No email address required.

Don't let ppl steal your 2fa

Jump in the discussion.

No email address required.

>with physical access

:marseynothingburger:

Jump in the discussion.

No email address required.

I mean, it probably doesn't effect a lot of peoples threat models but it's pretty bad for this kind of device.

Jump in the discussion.

No email address required.

Can you make it self destruct if disassembled? :marsey:

Jump in the discussion.

No email address required.

Doesn't seem like these ones do :marseyitsover:

That is a feature on some though.

Jump in the discussion.

No email address required.

That was my emotional support ounce of plastic explosive, it was not reasonably foreseeable that an officer of the peace would set it off, I hid it very well inside something I keep on my person at all times!

Jump in the discussion.

No email address required.

It probably doesn't affect anyone tbqh.

Jump in the discussion.

No email address required.

Jump in the discussion.

No email address required.

An attacker not only needs your username and password, they also need physical access to your key. They then have to disassemble the device. If they want to give it back to you, they'll need to reassemble it.

:#marseyshrug:

So if they have two factors of authentication they can break 2FA. I don't get what the big deal is??

Jump in the discussion.

No email address required.

I'm not really sure what is meant by "username and password" my yubikey just takes a physical press or NFC tap.

Jump in the discussion.

No email address required.

Presumably the first factor of authentication. Just the normal login

Jump in the discussion.

No email address required.

Ohh, they mean to websites.

Yeah I mean I'll continue using a secure password and password manager but this is still pretty bad if you were trying to prevent attackers.

Another thing the report mentions is this effects anything using that secure element so it might effect things like crypto wallets too.

Jump in the discussion.

No email address required.

>this is still pretty bad

No, it's really not. They need to steal your yubikey, disassemble it to make a copy, reassemble it to give it back to you so you don't notice it's missing. Then they also need to know your login info that requires the yubikey for MFA. There is zero threat here.

Jump in the discussion.

No email address required.

yeah I have over-reacted.

I'm curious to see if their warnings for other devices using the secure element come true.

It would be interesting if some old crypto stashes suddenly move in a couple months.

Jump in the discussion.

No email address required.

Shocking: if an attacker has the keys to your house and is standing in front of your house, they can enter your house :marseynothingburger:


:!marseybooba:

Jump in the discussion.

No email address required.

Naw, they copy the keys off the yubikey itself.

Jump in the discussion.

No email address required.

If an attacker takes my key they can make a copy by hand and hope I don't realize before they walk into my house

Jump in the discussion.

No email address required.

coming to PA for your physical keys :marseyglow:

Jump in the discussion.

No email address required.

:marseysweating#:

You can stay for some pierogis at least :marseyfluffy:

Jump in the discussion.

No email address required.

and i just bought 2 a couple months ago....

:#marseygiveup:

Jump in the discussion.

No email address required.

Same bruv, i think I've had mine for two years or so. Whenever apple added support.

Jump in the discussion.

No email address required.

An idiot admires complexity. A genius admires simplicity.

Snapshots:

https://www.yubico.com/support/security-advisories/ysa-2024-03/:

Jump in the discussion.

No email address required.

Sidechannel attack nothingburger that requires unrestricted physical access, disassembly of your key and probing with $100k++ equipment. This isnt some simple swipe and scan procedure that takes a few minutes. I wouldnt worry about it.

Jump in the discussion.

No email address required.

I've always wondered, at the end of the day the safety of these keys really depends on the manufacturing process. The NSA probably has a copy of every yubikey ever made

Jump in the discussion.

No email address required.

>The attacker would need physical possession of the YubiKey, Security Key, or YubiHSM, knowledge of the accounts they want to target, and specialized equipment to perform the necessary attack. Depending on the use case, the attacker may also require additional knowledge including username, PIN, account password, or authentication key.

Soooooooo, what is the vulnerability here? Not really going to matter to the average user who uses it for 2FA. Corporate datacenters, maybe.

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.