Hacker News Reader

Comment by arkadiyt | Hacker News Reader

The reason hardware 2fa keys like yubikeys are unphishable is that the browser controls the usb communication with the hardware key and passes the origin of the page to it - the page itself can't spoof an origin.

But with WebUSB a page _can_ communicate directly to a yubikey and pretend it's being asked to authenticate on a different origin. It's been fixed now but it was an interesting bypass:

- https://www.yubico.com/support/issue-rating-system/security-...

- https://www.wired.com/story/chrome-yubikey-phishing-webusb/

View on HN

Hmm this might not quite be WebUSB territory but it would be interesting to put a Yubikey in the cloud so it could be accessed from anywhere.

I've written this comment before bu what you need is a remotely controlled finger for pressing YubiKeys: https://bert.org/2020/10/01/pressing-yubikeys/

This is hilarious. The “final thoughts” section really hit home for me. Thanks for sharing

This gets us back to TOTP seeds in password managers. IMO that's a good model; physical stuff gets lost, broken, stolen, etc (hence one reason why you should not rely on SMS: It relies on a physical SIM card, and a physical device).

What is the advantage of yubikey over TOTP in that scenario though?

Isn't that just like storing a PassKey in iCloud Keychain?

what is interesting about that, and what purpose would it serve?

If you're far away from home, get mugged, you have nothing left on your person, and you need to get help, what do you do?

You have no cash, no wallet, no cards, no phone, no yubikey, nothing.

There's a public library next door where you can use an internet terminal to log into your Google Voice and G-mail and send an e-mail for help or call your family without needing cash on hand. Those websites enforce 2FA, so this is the solution to that.

(I realize this breaks the premise of 2FA, but it will get you back safely, which is probably more important on your Maslow hierarchy than some infosec policy.)

Reply on news.ycombinator.com