18

It is typically recommended to enable 2FA wherever possible. Moreover, it is typically recommended to enable not just any 2FA method, but Yubikeys in particular.

Yubikeys are considered to be the strongest available 2FA method. They are nigh-unbreachable, perhaps with the sole exception of if the user's machine is already fully compromised. However, they are considered to be immune to phishing attacks (methods such as e-mail, MsAuthenticator or SMS are not immune to phishing, since if I wrongly believe I am on a legitimate site I will gladly retype the code). In addition, other methods of 2FA also come with a host of their own problems, for example SMS is vulnerable to SIM jacking (maybe also traffic sniffing? im not 100% certain here), and e-mail is itself protected by a password as well as a possible 2FA method such as SMS, so my e-mail account can also be compromised. None of this affects Yubikeys. Proffessional pentesters often say that whenever they see someone is protected by Yubikeys they simply give up; but if they have no 2FA enabled or are protected by some weaker 2FA method, then pentesters say they are often succesful in compromising them in this way or another.

However, Yubikeys come with the downside that the key may be lost or damaged, in which case I may be locked out of all accounts that were protected by this key. To remedy this online services typically require that if I add a Yubikey I must have simultaneously enabled another method of 2FA.

Does this requirement not defeat all security improvements Yubikeys are supposed to provide? The whole system can only be as secure as its weakest link. Therefore, if I have both Yubikeys and <some other, weaker 2FA method> enabled, then I, effectively, only get as much protection as <some other, weaker 2FA method> can give me; all additional security provided by Yubikeys is, effectively, lost, is it not?

Is it true that if I have both Yubikeys and some other method of 2FA enabled then Yubikeys give me no additional security and therefore the ubiquitous requirement that Yubikeys must not be the only 2FA method enabled defeats the whole purpose of using Yubikeys?

If not, then were is my error?

4
  • 18
    Note: "Yubikey" is a brand name of one company. The standard is FIDO2, the generally accepted neutral term is "security key" or (for the passwordless mechanism) "Passkey". Jan 25 at 13:17
  • 5
    the idea with these security keys is that you buy two of them, register them both when setting up MFA, and store one of them in a safe place
    – Aaron F
    Jan 25 at 17:26
  • 1
    The physical security key is your convenient everyday no brainer auth method, and you never use the backup method unless you lose the key. If you ever need to use the backup, you stop to think and be extra careful. Unless you are an extremely high value target that should be more than enough, because it's highly unlikely anybody will ever simultaneously steal your Yubikey and set up SIM jacking to steal your backup method. Jan 26 at 7:58
  • 9
    @MattiVirkkunen It doens't matter that it's highly unlikely that someone steals both the Yubikey and SIM. They can simply go for one of those two; whichever is easier. That's what the question is about. Jan 26 at 9:03

5 Answers 5

14

2FA methods generally can be recovered; Authenticator Apps can be reinstalled on a different smartphone. SIM Cards can likewise be swapped to a new phone, if you want to continue using SMS verification. YubiKeys can be damaged or lost, without the possibility of recovery. This is why you need an alternative second factor when authenticating.

But, most websites I've come across recommend that your alternative method is a second YubiKey. I'm not aware of any websites that recommend your alternative be a completely different 2FA method, although I'm sure some exist. But a properly designed system wouldn't force a weaker alternative on you; it'll at most expect you to posses at least two keys.

Also, some methods might not be weaker per se, but just less convenient. An authenticator app, for instance, is great if you are the only one who needs access to the account. But if you've got a dozen coworkers logging in on a daily basis, having a small collection of yubikeys lying around means eveyone can log in without too much of a hassle. The authenticator app then will only be used as a last resort. In this case, the added convenience is perhaps even more important than the added security.

9
  • 3
    Having 2 keys with the same token also renders both compromised if one gets stolen.
    – Christian
    Jan 25 at 8:13
  • 5
    "if you've got a dozen coworkers logging in on a daily basis" - into the same account?
    – Bergi
    Jan 25 at 11:57
  • 2
    Unfortunately there are rarely companies that enforce the second 2FA to be not a Yubikey, namely Paypal.
    – GuiTaek
    Jan 25 at 18:25
  • 3
    @Michael: As of now, AWS allows multiple security keys to be registered to one account.
    – dhag
    Jan 25 at 20:03
  • 1
    You can also use a Yubikey to generate TOTP codes for sites which allow TOTP as a backup 2FA method
    – Josh
    Jan 26 at 15:47
10

One angle: just because weaker methods are available doesn't mean that you have to use them.

If YubiKey / FIDO2 / WebAuthn / passkeys are enabled, you can choose to always use them. This gets you both get the benefit of authentication of the origin, and also makes attempts to use other methods stand out as unusual. This obviously leaves a path for attackers to take, so it's not great. But you can choose to make it "less bad".

So even if an organization won't let you turn off the other factors (usually because they want to keep their support burden low, because it makes it harder for their customers to lock themselves out), you can still benefit from the strong phishing-resistant properties of FIDO2.

2
  • 8
    It makes the other methods stand out as unusual, but that's really only helpful if the service you're logging into alerts you of those unusual logins. Jan 25 at 20:51
  • Yeah, that's a very fair point. Services definitely need to empower good personal security telemetry. There's only so much we can do without work on their side. Jan 30 at 0:39
7

Your definition of "security" is too narrow. You're thinking only in terms of authentication, but not availability.

You may consider a Yubikey to give you great authentication security, but, by your own admission, "Yubikeys come with the downside that the key may be lost or damaged, in which case I may be locked out of all accounts that were protected by this key." That means that they provide poor availability security if used by themselves.

So, it isn't as straightforward as saying that Yubikey + another 2FA method is "less" secure than Yubikey by itself. Whether one is more secure than another depends on what your goals are. For example, consider an online account for paying parking fines vs an online account for internet banking.

I'm not really bothered if someone wants to pretend to be me and pay my parking fine. I am bothered if I am unable to login to pay the fine by the deadline and my fine increases as a result. In that scenario, availability has more importance than authentication. Typically security measures taken for such a site will simply be a reference number printed on the parking ticket and anyone with a copy of the ticket can login.

On the other hand, I'm willing to suffer a bit more inconvenience with accessing my internet banking in order to make sure nobody else can access it and spend my money. There, authentication is more important than availability. That's not to say availability is irrelevant. If I'm stranded in a foreign country it might be very important that I access my funds to pay for food / transport / accommodation etc. So in reality I'm willing to accept some authentication risk in order to improve availability.

Note also that it isn't a binary choice between high security with a Yubikey and low security with an alternative option. You can make a deliberate choice as to what that alternative is, to achieve the right balance for your use case. For example, a OTP locked in a bank vault probably doesn't have much impact on the security of a Yubikey, but provides a last resort option. In that example, we're fine tuning the balance: authentication security is reduced by a small amount, while we gain extra availability but at the price of it being inconvenient.

5

The security that a FIDO2 security key provides against phishing (i.e. authentication will fail for any domain except the one where the account was actually registered) is not lost because other authentication methods are activated, it is only lost when you use those other methods.

However, a phishing site could simply prompt you to use another method, maybe with some made-up but plausible sounding reason why the security key cannot be used. If you don't recognize that as suspicious (which is probably the case for most users), the phishing protection is lost.

Then again, this might still help with a risk based authentication approach - the server could recognize that a user who has always used a security key is suddenly using SMS auth, and flag the session as "suspicious", and deny certain operations.

0
2

Other answers have pointed out already a couple of benefits:

  • When you log in using the hardware key, you're protected against phishing attacks.
  • The alternative authentication method can increase your overall security by securing the availability of your account for legitimate use.

I would like to add that your analysis ─ that the attacker can choose to attack the weaker authentication method and achieve the same result ─ relies on the premise that both methods of authentication grant the same access. This doesn't need to be the case.

When I log into my bank's website, I can choose whether to authenticate using their app or by entering a (less secure) passcode. However, if I authenticate by my passcode then I won't be able to send money to not-already-trusted accounts, nor send money internationally, unless I reauthenticate using the more secure app.

This means an attacker who compromises my passcode can't so easily steal my money, although there is also some impact to availability if I lose my phone. I think that tradeoff is worth it. So this system is more secure than a system where both authentication methods grant full access, and therefore it's more secure than a system where only the weaker authentication option exists (and grants full access).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .