Hacker News Reader

Comment by GauntletWizard | Hacker News Reader

I would gladly take an old stock yubikey at a discount - my threat model doesn't have a serious need for resistance to stolen keys, because at the user level they're unlikely to not notice them missing for long enough to successfully attack and then replace to a keychain.

View on HN

You're joking, right?

The vulnerability, as another commenter mentions, is extremely hard to exploit and requires both physical access and the specific accounts to clone the key for.

That may be too much of a risk for enterprises, but as a personal security key? That seems like a completely reasonable choice to make.

No, I'm not. I've got a bunch of yubikeys locked in lockboxes when they're not in use, serving as trust anchors for internal PKI, but also using certificate logging. If one is compromised, there's a short window until it's known, and access to the box has a very small group of people. My threat model does not include "Insider under the watchful eye of two other insiders"

> My threat model does not include "Insider under the watchful eye of two other insiders"

Some Mastodon infosec grifter is going to name this "Insider Triple Threat".

A yubikey vulnerable to this attack perfectly protects against phishing, which is the attack the 99.9% of us have a practical reason to worry about.

Not all vulnerabilities are equal.

But so does a software password manager supporting passkeys – at a much lower price.

But lesser convenience and with more hassle.

You're right: a physical security key is a lesser convenience with more hassle than a personal password manager in my case.

But a software password manager on a compromised computer can be compromised, right? It feels like the secrets can't be extracted by a compromised computer: the attacker needs physical access to the Yubikey.

This sounds better than a software password manager, right? Or am I missing something?

Definitely, but GP mentioned

> [...] phishing, which is the attack the 99.9% of us have a practical reason to worry about [...]

Both physical and software authenticators protect just fine against that.

If he understands the risks and deems those manageable according to their threat model, I don't see a problem.

The attack is local, limited, and requires sophistication to pull off. For most people and most use-cases, this is a theoretical vulnerability rather than a real one.

While some users may need to buy updated YKs, perhaps having a tier of discounted "vulnerable" new old stock and more expensive patched new stock would make the most economic and utility sense.

Reply on news.ycombinator.com