Hacker News Reader

Comment by zahlman | Hacker News Reader

The attacker would need physical possession of the [key]... Depending on the use case, the attacker may also require additional knowledge including... PIN, account password, or authentication key.

If you already had both these things, any vulnerability in the key's firmware would be moot, surely? It's hardly a surprise that 2FA can be compromised by compromising both factors.

View on HN

The vulnerability allows extracting the secret key from a vulnerable device. If I remember correctly, it's after a successful auth / sign flow, which requires the login/password of the target website.

I could give you my security key and you'll be able to login once. If you can extract the key, then you could login without the security key. In the context of a targeted attack, that could heavily change the impact.

If you're paranoid, of course, you're not going to trust a key that's left your possession, even if you get it back later. One it's gone it should be revoked permanently.

That presumes you'd know.

It does. If you can get my yubikey off my keyring while it's in my pocket and put it back on without my noticing then I don't know how I can defend against that.

Sort of like how several plot points of the last Mission: Impossible movie could have been thwarted by a zipper.

... in hindsight :)

> If you can get my yubikey off my keyring while it's in my pocket and put it back on without my noticing

Yubikey security advisory: "Due to software vulnerability, always store in pocket".

And you can store things like your PGP keys on there. I use mine for code signing, ssh, and encryption. For me it’d just be a PITA, since I don’t operate in a very sensitive or valuable area, but it could be a nightmare for someone who signs code a lot of people use, for example.

What is your job where you need to give your key to lieutenant Chang daily?

The whole point of a YubiKey is that it can produce inextractable keys so it cannot be forged/cloned.

Without that property, might as well use a < 1$ Arduino clone that's 100x cheaper.

Are there < 1$ Arduino clones? How compatible are they with yubikeys? Are there any from trusted manufacturers? Any pointers?

Not $1, but you can get a JavaCardOS card and upload a FIDO applet yourself

https://github.com/token2/pin_plus_firmware https://github.com/BryanJacobs/FIDO2Applet

Probably will cost 5USD

Interesting, but "card" sounds like a different form factor, and Yubikeys do a fair but more than just FIDO2!

JavaCardOS can run in a USB-form factor as well. But that will not be 5USD. https://usasmartcard.com/usb-token/?page=1

In addition to FIDO2, you can add java applet for OpenPGP (also open source), TOTP (https://github.com/JavaCardOS/Oath-Applet) and PIV/smartcard (open source as well). I tell you more - there are tons of JavaCardOS compatible applets available on github etc.

The Yubikeys also support NFC, which is necessary for U2F authentication on Lightning iPhones.

Sorry I was not clear. Cards have NFC in any case. What is missing in cards is USB

Note I'm talking "clone of the Arduino", not "Arduino-based clone of the YubiKey". My point was that if you don't need protection against key extraction, you can just get an ultra-cheap microcontroler and write code to do the crypto operations on them.

This thread talks about sub-1$ Arduinos:

https://old.reddit.com/r/arduino/comments/dixa9x/awesome_sub...

I can't speak to the quality of those, but my friend got some sub-1$ Arduionos in the past (not sure which) and said they worked.

It's a matter of safeguards. If the arduino clone is remotely extractable, then you're not saving much.

That's the point. Yubikey can charge a premium on the assumption that what it sells is secure. If it sells old stock with known issues, what's the point?

Also I returned my yubikey to my $work when my contract ended so I know at least Microsoft reuses these keys.

> Also I returned my yubikey to my $work when my contract ended so I know at least Microsoft reuses these keys.

Or destroys them.

Is it the whole point? My understanding is that this attack requires physical access to the key. Would a compromised computer be able to extract the key without physically having the key? My understanding is that it wouldn't.

So having my private key on the Yubikey plugged into my computer is still safer than having the private key directly on the computer, right?

Yes, but my point is you could also have any ultra-cheap device plugged into your computer that can run general-purpose crypto software and talk via USB, or your phone.

You wouldn't have to pay > 50$ for a Yubikey.

> my point is you could also have any ultra-cheap device plugged into your computer that can run general-purpose crypto software and talk via USB,

But you would need this ultra-cheap device plugged into your computer to be resistant to your computer being compromised. Do you know such an off-the-shelf device?

> or your phone

Well your phone has a very large attack surface as compared to a Yubikey.

> You wouldn't have to pay > 50$ for a Yubikey.

Are you sure about that? I have a Nitrokey 3C NFC that cost more than my Yubikey, and the Nitrokey can be flashed from my computer. Meaning that if my computer is compromised, then my Nitrokey is compromised.

It's not clear to me that 50$ is expensive for a product that is not used by half the world and doesn't collect the private data of its users. I understand the frustration with the security issue, but I find it unfair to say "I would do better for < 1$".

The attacker would have to take the targeted YubiKey physically apart to get access to the Infineon chip. Then, after performing enough successful FIDO2 challenges (ie. logins with phished credentials) they would need to put the device back together, and do so without the victim noticing that their YubiKey has been physically compromised.

The keys are tamper-evident.

The attack is not impossible, and surely fits within the capabilities of nation state actors. For majority of other users it's a theoretical attack.

> The keys are tamper-evident.

No. Attacker replaces the shell.

So in your threat model the attacker is someone who has the resources to target you individually (plausible for high-value targets), the capability and capacity to further develop the physical field attack kit (current cost at ~11k for lab condition hardware), and can haul around essentially a mobile electrics oven - approximate size between a fusion splicer and a small 3D printer - to re-shell a decapped YubiKey.

I'm discounting the need to conduct phishing. That comes for free. I'll also give you that the victim may be rather unlikely to spot that their YubiKey has been replaced with a freshly manufactured copy.

For those kinds of capabilities you're still looking at nation state actors or very motivated enterprises.

> essentially a mobile electrics oven - approximate size between a fusion splicer and a small 3D printer - to re-shell a decapped YubiKey.

Not at all. Superglue is ample.

> For those kinds of capabilities you're still looking at nation state actors or very motivated enterprises.

And that's comfort?

Not comfort, but threat model.

Nation state actors have the resources to destroy me. Defending fully against them is cost prohibitive. I'll take basic actions to make it more expensive though.

My threat model is much less well resources actors who would happily sim-swap or password-stuff, etc, and there a ubikey is enough to foil those attacks. I have locks on my doors to prevent random teenagers and miscreants from walking in, not to prevent people motivated enough to pick the locks, break a window, or go through a wall.

> My threat model is much less well resources actors who would happily sim-swap or password-stuff, etc, and there a ubikey is enough to foil those attacks.

...whereas many users trusting the "industry’s #1 security key" pitch were relying upon a lot more.

As another commenter started to point out, the risk is essentially cloning the key. So, if you were out to dinner and it was cloned while you were out, you might not realize you'd been compromised whereas if it was stolen, it might too late, but you'd know. It seems that for many/most people the risk is low, but anyone at risk of a state sponsored attack should be aware.

For the threat model of keeping out random online attackers with no physical access, it seems this vulnerability doesn't matter.

Reply on news.ycombinator.com