23

Yubico offers the YubiKey Nano, a 2FA key designed to be left inside the device more or less permanently.

enter image description here

While it does add comfort to be able to just leave it plugged in, what risks would there be if the device was stolen with this still attached?

From what I could gather, local device accounts would have the same level of protection as a regular passphrase would provide. Online accounts, depending on the setup, would either have no protection at all (e.g. through a "Remember me on this device" function), or the same protection as a regular passphrase.

Is there anything I am missing?

Improve this question
4
  • 2
    I'm a little confused. Where the Yubikey is not a control, then the Yubikey is not a consideration, yes. Where the Yubikey is a control, then you can discount the control once it is stolen with the device since it is no longer providing benefit. But these statements seem obvious. Am I missing something? – schroeder♦ Jun 12 '20 at 10:18
  • 2
    @MechMK1 yes, on that case you lose all the usage of the key, that's why they state this on the comments of their video introduction "The YubiKey Nano is designed to be semi-permanently installed in laptops/iPad, with primary use to authenticate the machine rather than the user as it acts a simplified Trusted Platform Module (TPM). We've developed it based on user request" – Fabian Diaz Jun 12 '20 at 10:25
  • 1
    If the key is always used as a 2nd factor authentication, it's not a gaping security hole. But if it is, then it would be akin to leaving your car keys inside... – Pedro Jun 12 '20 at 14:29
  • FWIW, I have a Tile attached to my larger YubiKey. That helps offset the risk of losing the YubiKey. Works great :D – Dancrumb Jun 12 '20 at 20:46
42

The threat model for the Nano is protecting accounts from remote access, not from direct access from an approved device. You essentially make the device itself the "thing you have" factor with the benefit that the "thing's" properties cannot be stolen remotely (as is the case for private keys, cookies, etc.).

Convenient? Yes. Easy to add to your grandmother's laptop and everyone to forget about while still maintaining protection? Yes. Easy to lose? No. Are there "more secure" methods? Yes.

Improve this answer
9
  • But is it an increased security issue? If I walk away from my laptop with the key still plugged in can anyone now access my accounts secured with the key by pressing it? – Rob Jun 12 '20 at 21:46
  • 3
    @Rob increased compared to what? In what threat scenario? – schroeder♦ Jun 12 '20 at 23:34
  • 2
    @schroeder "More secure" methods: can you give an example please? – Kaymaz Jun 13 '20 at 6:57
  • 7
    @Kaymaz as alluded to in the question: removing the Yubikey – schroeder♦ Jun 13 '20 at 7:11
  • 1
    @Rob If they steal your key only, they still need to know your password. By that time you still can change your password, remove the key from the 2FA. That's also why you need more than 2keys or a different 2FA. If the only allowed device isn't in your possession anymore and you don't have the key anymore, it'll be a hard time to access your remote accounts. – Alexis Jun 13 '20 at 9:28
2

You can now sign into Microsoft 365 just using a FIDO2 Compatible device. You do not need to enter a password.

Microsoft 365 does make you assign a pin to unlock your device. So if someone steals it, they cannot use it to get into your 365 account without the pin. Even if they have you machine with your YubiKey 5 Nano in it, they still can't get into your 365 account without knowing the pin.

This method is far more secure than most other sign in methods.

Improve this answer
2
  • 1
    This isn't any different from a regular Password + 2FA combo mentioned in the question – MechMK1 Jun 14 '20 at 8:24
  • This is really different. The key cannot be copied, and destroys itself after few pins entries failed. So it is quite better than password + 2FA. – blue112 Jun 14 '20 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.