Privacy

32400 readers

177 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

[email protected]

Use ofSecurity' key from Yubico? (lemmy.ml)

submitted 2 months ago by [email protected] to c/[email protected]

22 comments fedilink hide all child comments

I wanna make more of myaccounts in the internet secure with two factor. I don't know much about it, but found out about Fido 2 and so. The security key my webbrowser shows often is the one from Yubico (BTW, I would like to get one that works with Linux, with USB and for phone with NFC) I got concerned when I noticed that Yubico is from USA, (??) Because I think NSA and thibgs like five eyes and so. Is there actually a risk that the for example is made an backdoor in the key?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 2 months ago (1 children)

They're not entirely un-auditable, either. A security flaw was discovered in the Yubikey 5 in one of the IC modules from a supplier, and they patched all of their keys from that point forward.

Unfortunately, all the 5's from before May 2024 are unpatchable (by design to prevent thieves from having an easy way into the key), but any key purchased now should be fine.

[–] [email protected] 2 points 2 months ago (2 children)

Well shoot, I guess it’s time to get a new security key. Am I better off switching to a NitroKey?

[–] [email protected] 4 points 2 months ago

That depends on your threat model. For most people, the attack is probably unlikely to affect them, but I would recommend reading about the flaw yourself. It's not hard to understand.

Also, this was not the fault of Yubico but a supplier, and instead of waiting for the supplier, Yubico patched the flaw themselves by providing a custom library.

Whether you should replace your current Yubikey 5 is up to you.

[–] dracs 3 points 2 months ago (1 children)

The issue isn't a big deal for the average user. The vulnerability required them to first get your username and password, physically steal your Yubikey, spend half a day using $10-15k worth of electronics equipment to repeatedly authenticate over and over, they then could potentially make a clone of the key.

[–] [email protected] 2 points 2 months ago

Haha well I feel less concerned now