Salta al contenuto principale

Why clone a yubikey when you can simply steal it and leave an identical looking one that just doesn't work and the user is just going to be confused for a bunch of time without realising that someone else has their 2FA token now

Nicolas Dandrimont reshared this.

in reply to Matthew Garrett

JP
JP
• •
user submits helpdesk ticket for new key, helpdesk doesn't revoke old one
in reply to Matthew Garrett

jaseg
jaseg
• •
They could actually make that type of attack much harder if they made the overmolding of these things in a nice swirly two-color process so each one is a bit different.
in reply to jaseg

Elena ``of Valhalla''
Elena ``of Valhalla''
•

@jaseg @Matthew Garrett

I'd just mention that for the latest solo (the 2fa key) they did a purple limited edition with *glitters* in the epoxy.

https://solokeys.com/products/limited-edition-solo-2a-nfc-security-key-built-with-trussed%C2%AE?srsltid=AfmBOopp5jPmovWgXkUfRVsL1R1QRG6gr7DOyoA8X5Lim8P4oN9vyce5

@Matthew Garrett @jaseg

Riley S. Faelan reshared this.

in reply to Elena ``of Valhalla''

jaseg
jaseg
• •
I think swirly plastic is better than glitter, because the glitter pattern does not appear unique at a glance. Only if you look closely will you notice the difference between two glitter patterns, so unless the user already suspects an attack and specifically checks, an attack would go unnoticed.
Questa voce è stata modificata (2 settimane fa)
in reply to jaseg

Elena ``of Valhalla''
Elena ``of Valhalla''
•
@jaseg @Matthew Garrett to be fair, I think that the plan was just to look cool, not to make the key unique
@Matthew Garrett @jaseg
in reply to Elena ``of Valhalla''

Lasse Beyer
Lasse Beyer
• •

@valhalla hopefully that glitter stuff is non-conductive. But why did they use the thinner traces for power supply and the wider traces for D+ and D-? 🤔

@mjg59 @jaseg

@Elena ``of Valhalla'' @Matthew Garrett @jaseg
in reply to Matthew Garrett

Graham Sutherland / Polynomial
Graham Sutherland / Polynomial
• •
honestly 90% of super fancy attacks feel useless in comparison with basic stuff designed to exploit "assume the user and support folks will be confused by something not working and take little to no remedial action". it should be a hard rule that everyone assumes computers will break in weird ways and will easily accept random-ass failures as a fact of life.
in reply to Matthew Garrett

paddleboard365
paddleboard365
• •
This is why my (not yubi) FIDO key is decorated by me. Also because I like it better that way, but obviously an important security thing that totally justifies me spending too many hours carefully engraving in plastic casing and painting in the lines...
in reply to Matthew Garrett

Sven Dowideit
Sven Dowideit
• •
shit. Can you please stop getting to the point so fast?
At least add a few pages of not quite relevant, but obtusely related content before you get to the leed!
in reply to Matthew Garrett

nebu
nebu
• •
How can we get a Mission Impossible 9 if the ubikey isn't going to be cloned??
To steal it is too much MI2
in reply to Matthew Garrett

JR Kelly
JR Kelly
• •
Now you'll make me paranoid bc mine almost never works right!
in reply to Matthew Garrett

The Vanu Phantom
The Vanu Phantom
• •
This. Social engineering and breaching physical security are the most likely attack vectors for most people! Keep your devices in your custody, and preferably, especially when in an environment that's easily accessible for hostiles (such as an office where I could just walk right in), keep the key on your body. I'd recommend a necklace or collar for that.
@tthbaltazar
@Tóth Gábor Baltazár
Questa voce è stata modificata (2 settimane fa)
in reply to Matthew Garrett

Anton Piatek
Anton Piatek
• •
exactly! With a blank or a defective one, and the user will just procure a new one assuming it died
in reply to Matthew Garrett

Hauke Musicaloris
Hauke Musicaloris
• •
That's because physical 2FA tokens combine the drawbacks of the 2FA process with the drawbacks of physical keys.
Questa voce è stata modificata (2 settimane fa)

Questo sito utilizza cookie per riconosce gli utenti loggati e quelli che tornano a visitare. Proseguendo la navigazione su questo sito, accetti l'utilizzo di questi cookie.

⇧