2

Now that I've purchased and programmed a couple of YubiKeys, I have a question about the security and usefulness of such security keys.

Assume in the following scenarios that one's username is easily guessed. For most professional cloud accounts, the u/n is the user's e-mail address.

With 2FA, an authenticator app on a well-secured phone, and a password, the process involves the familiar 'what you know' and 'what you have.' It is secure, unless a MITM sniffs multiple authentication codes. If the phone is lost or stolen, the likelihood of anyone's being able to use the authenticator is practically nil, because they'll be unable to unlock the phone.

With YubiKey, there is only the security key. It is not secured by a complex passcode, as the phone is. If the u/n is easily guessed and the YubiKey is stolen, an attacker would easily gain access.

So how is using a security key more secure?

2

It all comes down to what kind of threats you're protecting against, and which kind of compromise is most likely.

Sure, a YubiKey can't be protected with a PIN/pattern/fingerprint (although how much protection is a weak swipe pattern really giving you).

But it also (probably) can't be infected with malware, and it's a less appealing target for an opportunistic thief. It's probably also harder to link a random YubiKey found on the ground to an individual, whereas a phone is much more likely be be personally identifiable.

And most importantly, the YubiKey is highly unlikely to contain your username and password - whereas in many cases people will login to their accounts using their mobile phone, which means both factors can be obtained by compromising a single device.

5
  • 1) Thanks; makes sense. 2) But doesn't the security key in fact contain the u/n and p/c? For example, I connected my Microsoft 365 account to my YubiKey. If I go to the M365 login page, one option is to sign in with my security key. If I click that method, the key seems to send MS (whoami) plus passcode.
    – Joseph_N
    Aug 26 '21 at 15:26
  • Is that behaviour when you to go the login page on your own system (where you've previously used the key), or on any system? If I can just plug your YubiKey into my laptop and I'm logged straight into your M365 that's really bad.
    – Gh0stFish
    Aug 26 '21 at 15:51
  • 1
    Testing different machines to answer your question has raised more questions.... When the key is connected to a Windows machine and there's no cache with my login credentials, the browser asks for the key's PIN. So I'm okay with that, although in the future I'll use a better PIN. But--when the key is plugged in to a Mac or iPhone, the M365 login dialog does not even have a security key option. This is an issue, since I mostly purchased the YubiKey to get onto the cloud through GNU/Linux. I'll investigate and report back (unless you know the answer).
    – Joseph_N
    Aug 26 '21 at 19:07
  • Here is a couple of points to add some color to this conversation: 1) When you register a security key with Microsoft it is using the WebAuthn protocol behind the scenes. This does not store any usernames and passwords on the security key. Instead the protocol uses public key cryptography. The security key generates and protects the private key and gives the public key to Microsoft. 2) Microsoft requires a PIN, aka user verification, when authenticating the credential 3) WebAuthn client side discoverable credentials can store a GUID that the service can use to associate with your account. Aug 26 '21 at 20:58
  • @Gh0stFish you can have a PIN on a Yubikey. So in addition to it being somewhat anonymous compared to a phone, as you say, it can have a level of security.
    – Wayne
    Aug 27 '21 at 0:46
1

There are of course many use scenarios and variables. In general, assuming everything else is implemented well, it boils down to What You Have.

A properly implemented Yubikey cannot be cloned. It can be stolen, but ideally you would notice it was missing.

An authenticator can be copy/cloned. One can debate the difficulties involved but the end result is that the authenticator can be stolen but it would not be missing.

1

Using a Yubikey (or any other FIDO2/WebAuthN token) as a single factor is an option, but you certainly don't have to use it that way. There's literally nothing you can log into using only my Yubikey; it's the second factor I use on a ton of stuff (password manager, VPN, GitHub and Google and a bunch of other web sites / SSO providers, etc.). To get into them, you need my Yubikey (or a recovery key) AND my password.

In other words, you're really doing an apples-to-oranges comparison here. Nobody (that I've seen) uses an authenticator app as a single factor. It's a popular choice for a second factor, but by virtue of being a second factor, it's completely useless without the first factor (typically a password) too. I would argue that, in most cases, 2FA using password+TOTP authenticator app (on a separate device) is safer than 1FA WebAuthN using a Yubikey.

On the other hand, let's do an apples-to-apples comparison, and consider a Yubikey (or other FIDO2 token) vs. Google Authenticator (or other TOTP app) as second factors.

  • Phishing protection: HUGE win for the token. If you fall for a phishing page, you'll enter your TOTP code into it same as the legit login page, and the attacker will have access (at least for as long as they can keep the session alive... which is potentially a lot, if they can disable 2FA or enroll a new device using only the password). WebAuthN uses a handshake where the site (as reported by the browser) is one of the inputs; it simply won't work for a phishing site.
  • Long-term security / key exposure: Win for the token. You can't (at least not without a lot of rare skill, caustic substances, and an electron microscope) get the key out of a Yubikey. It's not exposed anywhere, even briefly. By comparison, backing up the TOTP key is usually easy if you have access to the app's data - some apps will optionally do it for you, usually to a cloud server - and of course the other party has to have presented you with the key (usually as a QR code) at some point, and also stored it in the server. That's a lot of opportunities for it to leak, much more easily than the token's key.
  • Ability to connect it to the user: Win for the token. It's pretty easy, generally speaking, to identify the owner of a stolen phone. Lots of people intentionally display that information, even. For a token, you wouldn't want to put your name on it (much less your email address or similar) any more than you'd put hour street address on your house key or your license plate number on your car key.
  • Ability to authenticate the user: Win for the app. All mobile OSes support lock functions and encryption that requires a passcode to unlock, and usually several other methods for convenience. Apps can have their own security on top of that. By comparison, Yubikeys (like most hardware tokens) will work for anybody.
  • Revocability: Small win for the token. Lots of sites will let you revoke a single hardware token without revoking others (such as the backup you hopefully have), but you can't revoke a single phone's TOTP app without revoking it on your old phone too (they don't usually allow multiple TOTP enrollments for one user at a time). On the other hand, you'll have to log into all those sites anyhow, so it won't cost you that much more time to rotate TOTP for each of them.

Overall, I think I much prefer the token's security, when comparing second factors.

2
  • That's not how my setup works. My key is currently paired with only two sites, because others I want to pair it with are either not configured to use a security key or require some coding that I haven't had time yet to do. For the two sites that I currently use with a YubiKey, both sites--if I'm using a supported platform and a supported browser--first ask me to enter the PIN for the key, then to trigger the key with a touch. That's it. The only "what you know" is the key's PIN.
    – Joseph_N
    Aug 30 '21 at 13:51
  • In other words, you're using it as ~1-factor, but comparing it to a 2-factor method. You presumably wouldn't (and indeed I don't know of any site that would let you) use TOTP alone to log in. Use it as a second factor instead, if you want more security than another 2FA method. Lots of sites support this (Google, Github, Facebook, and Okta all do, for example).
    – CBHacking
    Aug 30 '21 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.