Jump in the discussion.

No email address required.

Jump in the discussion.

No email address required.

An attacker not only needs your username and password, they also need physical access to your key. They then have to disassemble the device. If they want to give it back to you, they'll need to reassemble it.

:#marseyshrug:

So if they have two factors of authentication they can break 2FA. I don't get what the big deal is??

Jump in the discussion.

No email address required.

I'm not really sure what is meant by "username and password" my yubikey just takes a physical press or NFC tap.

Jump in the discussion.

No email address required.

Presumably the first factor of authentication. Just the normal login

Jump in the discussion.

No email address required.

Ohh, they mean to websites.

Yeah I mean I'll continue using a secure password and password manager but this is still pretty bad if you were trying to prevent attackers.

Another thing the report mentions is this effects anything using that secure element so it might effect things like crypto wallets too.

Jump in the discussion.

No email address required.

>this is still pretty bad

No, it's really not. They need to steal your yubikey, disassemble it to make a copy, reassemble it to give it back to you so you don't notice it's missing. Then they also need to know your login info that requires the yubikey for MFA. There is zero threat here.

Jump in the discussion.

No email address required.

yeah I have over-reacted.

I'm curious to see if their warnings for other devices using the secure element come true.

It would be interesting if some old crypto stashes suddenly move in a couple months.

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.