Hacker News Reader

Comment by Xylakant | Hacker News Reader

I would expect things to be more secure in many cases. People are pretty good at keeping physical items somewhat safe and notice when they’re gone. Yubikeys cannot easily be cloned. The password cannot be attacked remotely. 2FA is certainly safer, though.

View on HN

The standard in high-assurance applications is to present a PIN to the hardware token before it can be used, ideally through an out-of-band keypad.

In this context, it would be reasonable to have the Yubikey require a PIN entry from the computer. You could use the same PIN for all sites because it stays local; the relying party never handles it, only the Yubikey.

That's exactly how FIDO2 PIN on the new YubiKeys works.

Passwords are utterly broken. All the entropy of memorizable passwords among humans have probably been extracted by this point. All they give you is a false sense of security. The password portion of 2FA is mostly theater, conditioned on the notion that passwords are broken. Hardware keys is the way of the future.

Except that passwords at least protect you if your hardware key is stolen. Using just a hardware key seems similarly risky to just using a password.

What you need is a mechanism to detect loss of contact with the human and revoke. One way is to require several hardware tokens to combine their entropy to authenticate. Again, don't make a password be a part of this, use another token.

Exactly - It's similar reason to the crypto keys use passphrases.

So in this case, arent the two factors a) physical possession of desktop/laptop and b) the Yubikey ? How likely is it you'll lose both if you keep your keyring with you?

Not sure reading the article why would I need the computer. The way I read it, you enter the key to any computer and it logs in to the account of the key owner. Am I wrong?

FTA: "Organizations will soon have the option to enable employees and customers to sign in to an Azure AD joined device with no password, by simply using a Security Key to get single sign-on to all Azure AD based applications and services."

Emphasis added. Device needs to be paired with Company's AD first.

I also imagine that there are options for making e.g. the device unlock only require yubikey, but login to SSO require 2nd factor.

You can pair new devices with a company's active directory.

The two factors are a) the YubiKey and b) the PIN for the YubiKey.

Your hardware key is in one place, controlled by you. Your password has been leaked all over the internet.

Reply on news.ycombinator.com