this post was submitted on 21 Mar 2024
111 points (98.3% liked)

Privacy

31935 readers
764 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
k_o_t@lemmy.ml
tmpod@lemmy.pt
Yayannick@lemmy.ml
ranok@sopuli.xyz
111
Are hardware security keys worth it? If so, which to pick? (sh.itjust.works)
submitted 7 months ago by sugar_in_your_tea@sh.itjust.works to c/privacy@lemmy.ml
82 comments fedilink hide all child comments
 

This isn't strictly a privacy question as a security one, so I'm asking this in the context of individuals, not organizations.

I currently use OTP 2FA everywhere I can, though some services I use support hardware security keys like the Yubikey. Getting a hardware key may be slightly more convenient since I wouldn't need to type anything in but could just press a button, but there's added risk with losing the key (I can easily backup OTP configs).

Do any of you use hardware security keys? If so, do you have a good argument in favor or against specific keys? (e.g. Yubikey, Nitrokey, etc)

you are viewing a single comment's thread
view the rest of the comments
[–] pineapplelover@lemm.ee 17 points 7 months ago (1 children)

I bought 2 yubikeys. I try to use it for as many accounts as I can but I can only think of a handful who allow yubikeys. I would get them if you want to but a good 2fa should work fine. Most banks and actual important stuff barely have totp 2fa anyways.

[–] johannesvanderwhales@lemmy.world 4 points 7 months ago* (last edited 7 months ago) (1 children)

I think the best use case will be to use a yubikey with a password manager. That way it doesn't matter what sites support the security key directly. You could also set up passkeys with the sites so that once you authenticate with your password manager, the login process is transparent. Once more sites support passkeys, anyway.

[–] A1kmm@lemmy.amxl.com 2 points 7 months ago

I suggest having a threat model about what attack(s) your security is protecting against.

I'd suggest this probably isn't giving much extra security over a long unique password for your password manager:

  • A remote attacker who doesn't control your machine, but is trying to phish you will succeed the same - dependent on your practices and password manager to prevent copying text.
  • A remote attacker who does control your machine will also not be affected. Once your password database in the password manager is decrypted, they can take the whole thing, whether or not you used a password or hardware key to decrypt it. The only difference is maybe they need slightly more technical skill than copying the file + using a keylogger - but the biggest threats probably automate this anyway and there is no material difference.
  • A local attacker who makes a single entry to steal your hardware, and then tries to extract data from it, is either advantaged by having a hardware key (if they can steal it, and you don't also use a password), or is in a neutral position (can't crack the locked password safe protected by password, don't have the hardware key / can't bypass its physical security). It might be an advantage if you can physically protect your hardware key (e.g. take it with you, and your threat model is people who take the database while you are away from it), if you can't remember a sufficiently unique passphrase.
  • A local attacker who can make a surreptitious entry, and then come back later for the results is in basically the same position as a remote attacker who does control your machine after the first visit.

That said, it might be able to give you more convenience at the expense of slightly less security - particularly if your threat model is entirely around remote attackers - on the convenience/security trade-off. You would touch a button to decrypt instead of entering a long passphrase.