Privacy

31915 readers

723 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

111

Are hardware security keys worth it? If so, which to pick? (sh.itjust.works)

submitted 7 months ago by sugar_in_your_tea@sh.itjust.works to c/privacy@lemmy.ml

82 comments fedilink hide all child comments

This isn't strictly a privacy question as a security one, so I'm asking this in the context of individuals, not organizations.

I currently use OTP 2FA everywhere I can, though some services I use support hardware security keys like the Yubikey. Getting a hardware key may be slightly more convenient since I wouldn't need to type anything in but could just press a button, but there's added risk with losing the key (I can easily backup OTP configs).

Do any of you use hardware security keys? If so, do you have a good argument in favor or against specific keys? (e.g. Yubikey, Nitrokey, etc)

you are viewing a single comment's thread
view the rest of the comments

[–] octopus_ink@lemmy.ml 5 points 7 months ago* (last edited 7 months ago) (1 children)

If you don't mind, maybe you can answer this question for me. I finally jumped on the Yubikey train recently, added a couple accounts, no problem. But then I noticed apparently I can connect my key to any random install of the authenticator app on any device, and it will show the accounts I have protected with that key.

To me, this means if I lose my key someone can learn a fair bit about who owned that key just from looking at the accounts on their own phone when they find it on the street. Now someone knows I have the account myname@someemailprovider.com (among others) when they didn't know that before. Etc.

I have googled unsuccessfully to find out if for some reason this is less of a problem than I feel like it is, or if it can be masked somehow, but my keyword choices must have been poor.

Do you have any opinion on this? I googled specifically if it would allow you to set a PIN to unmask that info or similar, but the PIN articles I found seemed to relate to something else.

[–] solrize@lemmy.world 2 points 7 months ago (1 children)

I'm unfamiliar with how Yubikey works but I thought the FIDO2 protocol was designed to prevent that sort of association. Anyway it doesn't sound good. Cryptographer's saying (by Silvio Micali): "A good disguise should not reveal the person's height".

[–] octopus_ink@lemmy.ml 1 points 7 months ago (1 children)

Oh yeah it clearly seems a bad idea to me, which is why I'm assuming error on my part. 100% though I took an unrelated phone, installed the yubico app, slapped my nfc yubikey up to it, and could see my accounts listed.

[–] solrize@lemmy.world 2 points 7 months ago (1 children)

Oh I misunderstood what you were describing but yeah, it doesn't sound good. It sounds like the key is supposed to be an SSO credential for multiple phones? Maybe there's a way to set it up differently. You might ask their support.

[–] octopus_ink@lemmy.ml 1 points 7 months ago* (last edited 7 months ago) (2 children)

I probably described it poorly.

It's nothing that exotic. I use it as MFA for a few different accounts as I assume anyone who has one does. :)

Using one easy example, I have myname@anemailprovideryouveheardof.com set up and I can clearly see "myname@anemailprovideryouveheardof.com" as a linked account on my yubikey on any device. I can't do anything with it, but I see my username in the format shown above, and the one time code counting down.

I don't actually know why I haven't gone to their support - hadn't thought about it for awhile until reading this thread, so that's a good suggestion and will do.

[–] solrize@lemmy.world 2 points 7 months ago

Yeah it would be preferable IMHO if you had to enroll a newly installed app with username and password in addition to the key.

[–] goatmeal@midwest.social 2 points 7 months ago

I think y'all are talking about different things. Some sites (like google) have direct yubikey support where you plug the key into the device and what you're talking about isn't an issue

Other sites don't have direct support, but allow you to use any authenticator app which is what you're talking about with using the yubico authenticator app/key combination. Plugging it into a yubico authenticator app on any device will show the codes

Unfortunately I don't have an answer for a way to protect those other accounts. I guess the hope is that if you lose it, it can't be tied to your accounts, just the websites themselves