Comment by xvector | Hacker News Reader

Comment by xvector | Hacker News Reader

> We also instruct corporate users to set up Okta Verify for use only as a fallback MFA in the event that all their authenticators fail at once. This way, we never have user accounts lacking at least one strong form of multi-factor authentication.

Might as well not use a YubiKey at all. This just eliminates the benefits a YubiKey would provide. This reminds me of the banks that offer TOTP with fallback to SMS - just turns the "security improvement" into a waste of time and effort.

> We chose [Yubikey C NFC] for a few reasons: [...] 3. It doesn’t support OTP mode, so there’s no “Yubispam” to deal with

I think it does support OTP mode? Using one of these right now and it definitely supports OTP. You can turn it off, but that's not particular to the C NFC.

An aside: YubiKeys are great, I love them... but they need to have a display to show what, precisely, you're authenticating with, or signing, etc. You can never trust your computer's display - Ledger/Trezor's hardware wallets have the right idea. IMO current standards fall short in not providing this information to the hardware authenticator.

You’re mixing up two different models. You’re thinking of the $55 Yubico YubiKey 5C NFC https://www.yubico.com/product/yubikey-5-series/yubikey-5c-n... What they chose is the $29 Security Key C NFC by Yubico https://www.yubico.com/us/product/security-key-c-nfc-by-yubi... (note the word YubiKey does not exist in this model name) which does not have that feature.

Source: My company started providing these to employees and I was also initially confused by Yubico selling two different products with almost the same name.

One problem I have with switching exclusively to Yubikeys(or similar) entirely with no other 2FA option, is the lack of support in embedded browsers.

I’m not entirely sure what the support for this is like on Windows or some Linux systems, but for example on MacOS, if an application authenticates with SSO or something in an embedded browser window(one example would be like Cisco AnyConnect, but there are plenty of others. zScaler did recently update their MacOS client to authenticate inside a real full browser though so that’s nice), most every application I’ve come across uses the stripped down version of WebKit in these that doesn’t support FIDO2 or security keys at all, so I’m forced to use some other option like an authenticator app.

This is perhaps less of a problem depending on what types of auth your IDP supports, but for example with Microsoft it’s either Phone Call or SMS, their Authenticator app, or FIDO2.

This has improved leaps and bounds over the past year and a half.

I’ve been rocking FIDO2 with a Yubikey on macOS and iOS and it’s been solid. Support is there in web views. You can even use Yubikey-based PIV certificates now.

Not all of Microsoft’s apps have migrated to support this at the same pace. And anything still using ADAL over MSAL on iOS is going to probably ask for a different authentication path. Some of the older PowerShell modules don’t support FIDO2 or certificate authentication at all, but those are being rapidly deprecated.

You can just turn off the OTP configuration. Alas IIRC they ship with it 'on' out of the box so you get the 'cccjgjgkhcbbirdrfdnlnghhfgrtnnlgedjlftrbdeut' nonsense (with a newline for real fun win chat) whenever you brush against your laptop while reaching for a coffee.

> This reminds me of the banks that offer TOTP with fallback to SMS - just turns the "security improvement" into a waste of time and effort.

Not really. TOTP is mostly there to protect against password leakage, be it through shoulder peeking or digital means.

The SMS fallback still protects against all of these. A shoulder peeker can't read your texts if your phone is on default security, as message contents are not displayed on a lock screen without some form of unlock.

The digital attacker will need to remotely clone your SIM or do a SS7 attack, both which are out of the realm for 99.9% of attackers. And if you are truly at risk for this, you are important enough for the bank to have setup additional measures.

You will now probably bring up auth attacks via fake websites, but a TOTP doesn't protect against these. Only passkeys and physical keys do, and by far most banks don't yet support either :)

Call the phone operator: "I need a new simcard, I recently moved, can you send me one ? - yes yes no problems."

Considering you have to PIN €0.01 at the door, and the bank account has to match the bank account attached to the provider account, another virtually impossible attack :)

Unless someone has stolen your bank card and knows your PIN, in which case you have bigger problems.

TOTP is also vulnerable to good phishing attackes. You can convince someone to enter their creds and OTP code, which can be used remotely.

The value of the Yubi is that you need it physically, which can't be accomplished via phishing and other remote attacks.

Physical theft is much, much rarer, and if a laptop with Yubi in it is stolen the thief won't have your user/pass (unless it's on a sticky in your bag, etc). It's a very, very targeted attack if they phish your creds, then come steal your laptop, and you need more advanced protections than a yubi.

If there is a recovery mechanism that isn’t horribly annoying and secure, the yubikey is worthless.

If your recovery mechanism completely bypasses the benefits of using the YubiKey, that recovery mechanism is what your attackers will use.

At this point the YubiKeys only provide some measure of convenience. It's disingenuous for the blogpost to paint this as some meaningful security improvement if Okta Verify is the fallback. Feels like such a waste of time and effort to build something worthwhile and then undermine it just like that.

They want to have the ease of use AND the benefits - which can’t really happen.

You need to have a reliable and secure backup if you want to deploy yubikeys - or limit accounts that have been recovered until they’re revert fixed.

> If your recovery mechanism completely bypasses the benefits of using the YubiKey, that recovery mechanism is what your attackers will use.

I don't use any methods other than YubiKey when I do have my keys. So attackers cannot trick me. If I see a choice without Yubikeys I immediately know I'm being phished.

We’re talking about what happens if you lose your keys. If all I need to do is call and say “this is netheril96” and they’ll give me access, the yubikey is theatre.

Reply on news.ycombinator.com