this post was submitted on 21 Mar 2024
111 points (98.3% liked)

Privacy

31893 readers
428 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
k_o_t@lemmy.ml
tmpod@lemmy.pt
Yayannick@lemmy.ml
ranok@sopuli.xyz
111
Are hardware security keys worth it? If so, which to pick? (sh.itjust.works)
submitted 7 months ago by sugar_in_your_tea@sh.itjust.works to c/privacy@lemmy.ml
82 comments fedilink hide all child comments
 

This isn't strictly a privacy question as a security one, so I'm asking this in the context of individuals, not organizations.

I currently use OTP 2FA everywhere I can, though some services I use support hardware security keys like the Yubikey. Getting a hardware key may be slightly more convenient since I wouldn't need to type anything in but could just press a button, but there's added risk with losing the key (I can easily backup OTP configs).

Do any of you use hardware security keys? If so, do you have a good argument in favor or against specific keys? (e.g. Yubikey, Nitrokey, etc)

you are viewing a single comment's thread
view the rest of the comments
[–] solrize@lemmy.world 2 points 7 months ago (1 children)

I'm unfamiliar with how Yubikey works but I thought the FIDO2 protocol was designed to prevent that sort of association. Anyway it doesn't sound good. Cryptographer's saying (by Silvio Micali): "A good disguise should not reveal the person's height".

[–] octopus_ink@lemmy.ml 1 points 7 months ago (1 children)

Oh yeah it clearly seems a bad idea to me, which is why I'm assuming error on my part. 100% though I took an unrelated phone, installed the yubico app, slapped my nfc yubikey up to it, and could see my accounts listed.

[–] solrize@lemmy.world 2 points 7 months ago (1 children)

Oh I misunderstood what you were describing but yeah, it doesn't sound good. It sounds like the key is supposed to be an SSO credential for multiple phones? Maybe there's a way to set it up differently. You might ask their support.

[–] octopus_ink@lemmy.ml 1 points 7 months ago* (last edited 7 months ago) (2 children)

I probably described it poorly.

It's nothing that exotic. I use it as MFA for a few different accounts as I assume anyone who has one does. :)

Using one easy example, I have myname@anemailprovideryouveheardof.com set up and I can clearly see "myname@anemailprovideryouveheardof.com" as a linked account on my yubikey on any device. I can't do anything with it, but I see my username in the format shown above, and the one time code counting down.

I don't actually know why I haven't gone to their support - hadn't thought about it for awhile until reading this thread, so that's a good suggestion and will do.

[–] solrize@lemmy.world 2 points 7 months ago

Yeah it would be preferable IMHO if you had to enroll a newly installed app with username and password in addition to the key.

[–] goatmeal@midwest.social 2 points 7 months ago

I think y'all are talking about different things. Some sites (like google) have direct yubikey support where you plug the key into the device and what you're talking about isn't an issue

Other sites don't have direct support, but allow you to use any authenticator app which is what you're talking about with using the yubico authenticator app/key combination. Plugging it into a yubico authenticator app on any device will show the codes

Unfortunately I don't have an answer for a way to protect those other accounts. I guess the hope is that if you lose it, it can't be tied to your accounts, just the websites themselves