Privacy

31276 readers

661 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago

MODERATORS

111

Are hardware security keys worth it? If so, which to pick? (sh.itjust.works)

submitted 6 months ago by sugar_in_your_tea@sh.itjust.works to c/privacy@lemmy.ml

82 comments fedilink hide all child comments

This isn't strictly a privacy question as a security one, so I'm asking this in the context of individuals, not organizations.

I currently use OTP 2FA everywhere I can, though some services I use support hardware security keys like the Yubikey. Getting a hardware key may be slightly more convenient since I wouldn't need to type anything in but could just press a button, but there's added risk with losing the key (I can easily backup OTP configs).

Do any of you use hardware security keys? If so, do you have a good argument in favor or against specific keys? (e.g. Yubikey, Nitrokey, etc)

you are viewing a single comment's thread
view the rest of the comments

[–] octopus_ink@lemmy.ml 1 points 6 months ago* (last edited 6 months ago) (2 children)

I probably described it poorly.

It's nothing that exotic. I use it as MFA for a few different accounts as I assume anyone who has one does. :)

Using one easy example, I have myname@anemailprovideryouveheardof.com set up and I can clearly see "myname@anemailprovideryouveheardof.com" as a linked account on my yubikey on any device. I can't do anything with it, but I see my username in the format shown above, and the one time code counting down.

I don't actually know why I haven't gone to their support - hadn't thought about it for awhile until reading this thread, so that's a good suggestion and will do.

[–] goatmeal@midwest.social 2 points 6 months ago

I think y'all are talking about different things. Some sites (like google) have direct yubikey support where you plug the key into the device and what you're talking about isn't an issue

Other sites don't have direct support, but allow you to use any authenticator app which is what you're talking about with using the yubico authenticator app/key combination. Plugging it into a yubico authenticator app on any device will show the codes

Unfortunately I don't have an answer for a way to protect those other accounts. I guess the hope is that if you lose it, it can't be tied to your accounts, just the websites themselves

[–] solrize@lemmy.world 2 points 6 months ago

Yeah it would be preferable IMHO if you had to enroll a newly installed app with username and password in addition to the key.