14
Sanity check: Yubikeys and password shares
(reddthat.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 04 Sep 2024
14 points (100.0% liked)
Cybersecurity
5631 readers
26 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !cybersecurity@lemmy.capebreton.social !securitynews@infosec.pub !netsec@links.hackliberty.org !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub
Notable mention to !cybersecuritymemes@lemmy.world
founded 1 year ago
MODERATORS
All it takes to sync TOTP is to manually set up the secrets on all keys.
Keeping a second factor in a password manager makes it a single factor, doesn’t it?
It depends. Do you need MFA to access the password manager?
If not, then yes it reduces the effectiveness of having MFA on your accounts but they are still more secure than not having MFA at all.
The password vaults do have MFA already. So they'd still need a password and the upgraded hardware key to get into the vaults.
So let's say I'm at work, I set up
NewAccountto useYubikey A. Partner hasYubikey Band isn't nearby. How would I share or retrieve that secret key later? My understanding is that's not possible if it's stored on the key, but maybe I'm wrong.If you're just storing the password on the key then, no you can't get it unless you have the key. The main usage (arguably) for a yubikey is the FIDO2 auth method where you add those keys as MFA methods. That would allow access using either key.
I think of that like putting multiple things in the same basket, but putting two locks on that basket.
Thanks, that's kind of what I was thinking.
Sounds like a YK5 might still be a viable use case, but I'd have to do a deeper analysis of what account 2FA secrets would need to be shared versus which can be relegated onto individual keys and safely lose that "always accessible anywhere" trait.
I’m not evaluating whether or not you should do that, but, assuming you trust your partner and their op sec, you could send them the secret via a disappearing message on Signal or some other E2E encrypted communication method.
You set it up on your key, they add it to theirs later, the secret disappears into the ether.
Something to consider, certainly. Might be more complexity than my partner is willing to handle, but I'll have to have that conversation with them.