this post was submitted on 11 Oct 2024
29 points (96.8% liked)

Privacy

32412 readers
405 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

I wanna make more of myaccounts in the internet secure with two factor. I don't know much about it, but found out about Fido 2 and so. The security key my webbrowser shows often is the one from Yubico (BTW, I would like to get one that works with Linux, with USB and for phone with NFC) I got concerned when I noticed that Yubico is from USA, (??) Because I think NSA and thibgs like five eyes and so. Is there actually a risk that the for example is made an backdoor in the key?

top 22 comments
sorted by: hot top controversial new old
[–] mp3@lemmy.ca 20 points 2 months ago* (last edited 2 months ago) (4 children)

The firmware is indeed closed-source, so it's hard to audit. But they're popular, and a security flaw wouldn't go unnoticed for long.

There are other vendors such as NitroKey offers an alternative that offers both open source and audited hardware and software.

[–] yonder@sh.itjust.works 5 points 2 months ago

I personally went with a yubikey because their form factor is pretty slick. I'm not to worried about damaging the key.

[–] Charger8232@lemmy.ml 4 points 2 months ago (1 children)
[–] toastal@lemmy.ml 2 points 2 months ago
[–] Telorand@reddthat.com 4 points 2 months ago (1 children)

They're not entirely un-auditable, either. A security flaw was discovered in the Yubikey 5 in one of the IC modules from a supplier, and they patched all of their keys from that point forward.

Unfortunately, all the 5's from before May 2024 are unpatchable (by design to prevent thieves from having an easy way into the key), but any key purchased now should be fine.

[–] compostgoblin@slrpnk.net 4 points 2 months ago (2 children)

Well shoot, I guess it’s time to get a new security key. Am I better off switching to a NitroKey?

[–] Telorand@reddthat.com 5 points 2 months ago

That depends on your threat model. For most people, the attack is probably unlikely to affect them, but I would recommend reading about the flaw yourself. It's not hard to understand.

Also, this was not the fault of Yubico but a supplier, and instead of waiting for the supplier, Yubico patched the flaw themselves by providing a custom library.

Whether you should replace your current Yubikey 5 is up to you.

[–] dracs@programming.dev 3 points 2 months ago (1 children)

The issue isn't a big deal for the average user. The vulnerability required them to first get your username and password, physically steal your Yubikey, spend half a day using $10-15k worth of electronics equipment to repeatedly authenticate over and over, they then could potentially make a clone of the key.

[–] compostgoblin@slrpnk.net 2 points 2 months ago

Haha well I feel less concerned now

[–] FriedRice@lemmy.ml 3 points 2 months ago

Thank you. I will look into it.

[–] OhVenus_Baby@lemmy.ml 8 points 2 months ago (2 children)

I been wanting a yubikey but the fact their not open source really kills it. Any alternatives that are still iron clad?

[–] 4vgj0e@lemmy.world 2 points 2 months ago

https://solokeys.com/

I found this a few months, I have yet to purchase and try it for myself.

[–] chevy9294@monero.town 1 points 1 month ago (1 children)
[–] OhVenus_Baby@lemmy.ml 2 points 1 month ago

I'm gonna check them out thanks.

[–] trevor@lemmy.blahaj.zone 3 points 2 months ago* (last edited 2 months ago)

FYI: the people in here recommending the open source competitors for Yubico aren't mentioning one thing: YubiKeys, being proprietary, support a proprietary protocol called Yubico OTP in addition to the FIDO authentication protocol that the open source competitors can do.

The reason this matters is that some applications, like the Linux Bitwarden desktop app (there are others, but this is one that I've had to deal with), don't support FIDO authentication, but do support Yubico OTP. This means that, for those apps, the open source keys wouldn't be a valid authentication method.

Granted, the number of applications like this are small, and probably grows smaller by the day, but it's an important distinction to be aware of.

[–] utopiah@lemmy.ml 3 points 2 months ago (1 children)

I mean it's very complex and very expensive for "just" a key but if you want something fully auditable maybe Precursor.dev is a good fit. It's more than a key but the point is that it's as open as it can be. Honestly I'd consider it more a learning adventure that an tool at this point but still, see https://www.bunniestudios.com/blog/2022/towards-a-more-open-secure-element-chip/ for the philosophy and https://github.com/betrusted-io/xous-core with Vault for the key aspect specifically.

[–] chevy9294@monero.town 1 points 1 month ago

Damn thats interesting! I would love to get one but currently I wouldn't pay 500$ because I don't have enough knowlage yet to do fun things with it.

[–] double_oh_walter@sh.itjust.works 2 points 2 months ago (1 children)

Isn’t Yubico (at least in part) Swedish?

[–] FriedRice@lemmy.ml 1 points 2 months ago (1 children)

I thought so too, but it might only be manufactured there

[–] double_oh_walter@sh.itjust.works 2 points 2 months ago* (last edited 2 months ago)

The founder lady is (somewhat) Swedish and it was incubated at KTH Royal Institute of Technology. That’s what I gathered from Wikipedia anyhow.

I would imagine the keyes would be more expensive if manufactured there.

[–] FriedRice@lemmy.ml 2 points 2 months ago

I have now looked into Nitrokey, and I'm convinced that I will get me one of these. I would use it to log in to my pc, which has Fedora 40.I do I understand it right, that i f I follow the steps in the following link, I can use it to log into my PC?

[–] chevy9294@monero.town 2 points 1 month ago

Yubikeys are defenetly the most popular ones, but I prefer Nitrokey which is based in Germany and open-source. I have 3 Nitrokeys and I'm very happy with them.