My friends and I have worked at various tech companies which required us to use a security key in order to login to our computers. Some of us had to physically "touch" the device to login, while some of us at other companies did not need to touch our key.

Does the addition of having to touch the security key add any additional security? If so, how? If not, what is the purpose of it?

  • Provide more details. 1) What devices were used exactly. 2) What do you mean by "touching"? Touching like touchpad? Or do you mean finger print reader? – mentallurg Apr 3 at 0:58
  • 1
    I'm guessing they are referring to the capacitive touch points on e.g. Yubikey. – multithr3at3d Apr 3 at 1:01
  • Sadly one implementation I encountered used a Yubikey touch as a way to enter a password at the password prompt. The Yubikey was set to a mode that used no cryptographic functions at all, it simply spit out clear text in HID mode upon touch. – user10216038 Apr 3 at 3:31
  • @mentallurg Yes, they are capacitive touch points, similar to a Yubikey. – stoicfury Apr 3 at 5:21
  • @user10216038 that sounds like HOTP mode, which is still a one-time unique cryptographic output. – multithr3at3d Apr 3 at 15:40

Touch is the one thing that cannot be forged

The idea with hardware security tokens is that secret crypto keys are stored on the token itself. Even if the computer/device it plugs into is compromised, the secret keys cannot be stolen.

Usually, PIN entry is required by the token in order to start performing cryptographic operations. For convenience/usability, the PIN is often cached for a period of time, not requiring re-entry during this time.

Imagine that you use your security token to sign code, decrypt secrets, or SSH into servers. Once the token is unlocked, any of these operations can take place without further user interaction.

Now imagine your computer is compromised. Once you've entered your PIN, the attacker may be able to perform the above cryptographic tasks using your token without your knowledge. Even if you require the PIN on every operation, the attacker could keylog or capture it, and possibly present it for unlock.

Here's where the touch feature comes in handy. By requiring a touch, the token won't perform any cryptographic operations without confirmation from the user physically sitting at the computer. Of course, it doesn't protect against a physical attack, but that's already game over.

Now, while this gives a layer of protection against inadvertent or malicious operations with your secret keys, a remote attacker is not necessarily foiled by it. They may still backdoor your tools to insert malicious code into signed commits, copy your decrypted secrets, and hijack your SSH client to gain access to your servers.

I'd guess that it provides little to no benefit if you are only using it to log in locally.

  • Ahh I see. So it seems that all the 'touch' aspect does is ensure the physical presence of the user at the computer during every cryptographic operation; without the touch requirement, if the device remains plugged in to the computer, cryptographic operations can be performed at any time. Thanks. :) – stoicfury Apr 3 at 5:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.