Hacker News Reader

Comment by Stratoscope | Hacker News Reader

Lately I've been working at a company that uses YubiKeys for 2FA. You can use a traditional YubiKey, but the YubiKey Nano is especially popular because you can put it in your laptop and leave it there. It barely sticks out at all, just enough that you can touch it and activate the touch sensor. [1]

I started noticing people in meetings with their new MacBook Pros and six inch cords sticking out the side, and on closer inspection, there was a YubiKey Nano plugged in at the end of the cord.

Meanwhile, the folks with ThinkPads or older MacBooks just had a Nano tucked into one of their USB-A ports like it was no big deal.

I know which I would pick.

[1] https://www.amazon.com/dp/B018Y1XXT6/

View on HN

I bought myself the full sized Yubikey instead of the nano because I'm very much of the opinion that the inconvenience is a feature, not a bug — do you _really_ want to leave your Yubikey attached to the device that holds your password manager too?

That said, the problem you described is a temporary one — while not as neat as the USB-A variant, there is a USB-C Yubikey Nano. https://www.yubico.com/product/yubikey-4-series/#yubikey-4c-...

That's a great point about not leaving the YubiKey plugged into the laptop all the time. But the company actually suggests that people get a Nano and leave it plugged in for convenience. Maybe that isn't the best security advice!

Thanks for the pointer to the USB-C YubiKey Nano - it looks like a fine solution for the dongle problem.

I don't understand - why don't they just get USB-C compatible YubiKeys if they have USB-C laptops?

The company would have to provision and deploy those, and these things take time and money.

You could purchase your own, I suppose.

That's even more funny, because the MBP's touch-bar is essentially the same type of device as the YubiKey—an isolated offboard CPU with its own TPM that can be unlocked with a fingerprint and then asked to encrypt secrets for the host/parent PC. The touch-bar just has more screen.

I'm surprised nobody's hacked the YubiKey app into making use of the touch-bar as the YubiKey "device."

Doesn't that kind of defeat the point of the Yubikey? I would think you would want to separate the key and the computer when you yourself are separated from your computer.

The copy on the Yubikey Nano's website says, "designed to remain in port." Removing it is still an option, but it doesn't sound like it's the point of having it.

You can also use the fingerprint sensor as a replacement for the ubikey. Which works arguably as well - at least it satisfies the criteria that you separate the key and the computer when you yourself are separated from the computer.

The device still requires a pin for most operations (depending on how it's configured), and locks itself if the wrong pin is used too many times.

https://github.com/github/SoftU2F

How would you change your fingerprint if it is compromised? Yubikey can be swapped at any time.

It’s implemented as a auth mechanism to memento, it might be open sourced at some point.

The reason yubikey doesn’t do this is that it will kill their business and product.

https://github.com/github/SoftU2F

https://www.yubico.com/product/yubikey-4-series/#yubikey-4c-...

Yes, I too base my decisions of which laptop to buy based on how a YubiKey looks.

It's not just a cosmetic issue. The people with the six inch cords are leaving them plugged into the laptop all the time as they walk around the building, just like the people with the USB-A ports are leaving their YubiKeys plugged in all the time.

The difference is that if they bump into somebody or something, that dongle is likely to get broken, and it could even damage the USB-C port in the MacBook. That's not going to happen with a Nano plugged directly into a USB-A port.

Right, it’s important that the whole world stand still for a decade because of some fucking “YubiKey dongle”.

Calm down. It's not just YubiKey. The world isn't moving to USB-C everything for a while yet.

Reply on news.ycombinator.com