Hacker News Reader

Comment by gwbas1c | Hacker News Reader

> primary goal is to fight the scourge of phishing attacks. The EUCLEAK attack requires physical access to the device

Something to consider: If someone is going to go through the effort to get physical access to a Yubikey, they only need to swap it with one that has a similar level of wear and a similar appearance. At that point, the victim will merely believe that their Yubikey is broken; and/or the attacker will have enough time to use the Yubikey.

For example, I have two Yubikeys. Someone could sneak into my house, swap my spare, and I wouldn't figure it out until I go to use my spare.

Basically: This attack is only "worth it" if your target is so valuable that you can target them in person. At that point, I'd think the target would use something a little more secure than a Yubikey.

View on HN

> At that point, the victim will merely believe that their Yubikey is broken; and/or the attacker will have enough time to use the Yubikey. For example, I have two Yubikeys. Someone could sneak into my house, swap my spare, and I wouldn't figure it out until I go to use my spare.

You can inspect a yubikeys identity with `ykman list` so you can easily have checks to check if a yubikey is broken or actually swapped. If you have high security requirements you can do this periodically and/or have the physical location of the spare be physically secured.

> use something a little more secure than a Yubikey

For a hardware authenticator what would that be?

> You can inspect a yubikeys identity with

Who's going to do that? Most of the time, when I use my Yubikey, I'm using it in a text field in a website.

But, to quote https://news.ycombinator.com/item?id=41439400

> Seriously, it's trivial to fry a key and swap it with the working spare if you have access to it

So all an attacker needs to do is swap my Yubikey with a fried one. Maybe someone will figure it out if they're tracking the numbers written on the outside.

> Who's going to do that?

The point is that if you require more security there are tools to check it. For me I'm comfortable enough that an attack requires physical access to my keys, so I don't.

> Maybe someone will figure it out if they're tracking the numbers written on the outside.

So if your opsec requires it keep track of which keys you have and their identities. If one is fried remove it from all the services you authenticate with.

I'm not saying its perfect but you can create practices/procedures that protect (or at least let you know it happened) from most realistic attacks.

Seriously, it's trivial to fry a key and swap it with the working spare if you have access to it

> Basically: This attack is only "worth it" if your target is so valuable that you can target them in person. At that point, I'd think the target would use something a little more secure than a Yubikey

Absolutely.

In practice, the Yubikey is almost never going to be the weakest link in the chain. They could target your devices, intercept your communications, or serve warrants on/covertly exploit the services that host your data.

Reply on news.ycombinator.com