Topic: 2FA HW security keys, Yubikey&such. (Read 1107 times)
bump
In terms of mechanical strength Yubikey 5 USB-A has the linchpin. When you plug the key horizontally into USB port and accidentally push it down with force while touching golden plate it bends and may break down. To prevent this I plug the key only vertically and touch it on both sides so as not to bend
In any case, the yubikey looks much stronger and more durable than the teresor. It would be nice to get the Trezor developers to think about improving their devices a bit so that they don't look like empty plastic boxes. It would be great if the Trezor was also completely monolithic.
Agree, Yubkey 5 is strong enough if you don’t try to bend it. I think it’s also well protected from moisture and can work even after it’s been in the water (although I didn’t check it out). Yibikey 5 USB-C is even more stronger than USB-A because it has the metal shell around its USB connector. I don't have Trezor, I have Ledger and it also has the option to install U2F and use it for authentication but I prefer Yubikey to do this.
Special leather covers are sold for the Trezor, they certainly increase its mechanical strength, but still, in terms of strength, it loses much to the yubikey. And i think even if the Trezor will is in a leather case and someone weighing over 200 pounds steps on it with their heels, not even a leather case will help him.
In terms of mechanical strength Yubikey 5 USB-A has the linchpin. When you plug the key horizontally into USB port and accidentally push it down with force while touching golden plate it bends and may break down. To prevent this I plug the key only vertically and touch it on both sides so as not to bend
Another point in favor of using for authorization purpose HW security keys instead of Trezor (or Ledger) is that the latter has more electronics components inside (display itself and related biasing circuits it requires) thereby wallets in general are less reliable devices, so one shouldn't trust them his/her accounts, could fail at any time.
yubikeys dont have a usb controller chip afaik (according to yubikey anyway, its a custom deal as it doesnt need full usb functionality) so its immune.
USB interface in yubikey is CCID. Devices with such type of USB interface are vulnerable to BadUSB attack in only one case when their firmware update is allowed. Firmware update is disabled for Yubikey and there is no way to do it thereby the device doesn't inherently have BadUSB vulnerability, it's immune as you said.
Yubikey is great - I bought my first Yubikey back in 2016, but the problem is that I didn't fasten it to my keychain and ended up losing it after a couple of months. Since then, I regularly use my Trezor as a second factor. If someone is not in the know, then I remind you that any Trezor, in addition to the function of a wallet for cryptocurrencies, can be used as a second factor for authentication. Very convenient indeed.
yes, trezor is a good backup to a yubikey.
of course i like having several yubikeys for just such a situation.. lost or broken although it seems awful tough to break.
also a yubikey doesnt scream "crypto" if you use it in public for 2fa.
another advantage a yubikey has over a trezor -- no bad usb infection possible. which i believe (not entirely sure) a trezor is susceptible to.
i use both btw
Agree, having two or even three instances of yubikey is a good practice to be prepared for accidental loss or failure. I have two of them, one as backup. One of multiple advantages of Yubikey 5 over Trezor or Ledger is that it offers plenty of authentication protocols that should cover industry's needs for years. It is far more innovative than those keys that were built in 2016.
In terms of mechanical strength Yubikey 5 USB-A has the linchpin. When you plug the key horizontally into USB port and accidentally push it down with force while touching golden plate it bends and may break down. To prevent this I plug the key only vertically and touch it on both sides so as not to bend
In any case, the yubikey looks much stronger and more durable than the teresor. It would be nice to get the Trezor developers to think about improving their devices a bit so that they don't look like empty plastic boxes. It would be great if the Trezor was also completely monolithic.
Special leather covers are sold for the Trezor, they certainly increase its mechanical strength, but still, in terms of strength, it loses much to the yubikey. And i think even if the Trezor will is in a leather case and someone weighing over 200 pounds steps on it with their heels, not even a leather case will help him.
but step on a trezor vs step on a yubikey. yeah no contest.
There's also a metallic one (made from aluminium), this might be fine when stepped on but it's expensive compare to every other hardware wallet on the market.
oops forgot that one. i did want a couple when i saw them too.
but step on a trezor vs step on a yubikey. yeah no contest.
There's also a metallic one (made from aluminium), this might be fine when stepped on but it's expensive compared to every other hardware wallet on the market.
The yubikey is small and very tight to the touch, and really has nothing to break unless it is exposed to very high temperatures. Therefore, in terms of reliability, it is great.
He is not afraid of water, he is not afraid of falls even from great heights. The same cannot be said about Trezor.
If the Trezor gets caught in heavy rain or falls into the water, then everything will be over with him. Therefore, they are both good, but each in their own area.
He is not afraid of water, he is not afraid of falls even from great heights. The same cannot be said about Trezor.
If the Trezor gets caught in heavy rain or falls into the water, then everything will be over with him. Therefore, they are both good, but each in their own area.
fresh or grey water in a trezor may not kill it if dried/cleaned properly. yubikey doesnt care of course.
but step on a trezor vs step on a yubikey. yeah no contest. but ive dropped a trezor from like 4 or 5 feet dozens of times too.
The yubikey is small and very tight to the touch, and really has nothing to break unless it is exposed to very high temperatures. Therefore, in terms of reliability, it is great.
He is not afraid of water, he is not afraid of falls even from great heights. The same cannot be said about Trezor.
If the Trezor gets caught in heavy rain or falls into the water, then everything will be over with him. Therefore, they are both good, but each in their own area.
He is not afraid of water, he is not afraid of falls even from great heights. The same cannot be said about Trezor.
If the Trezor gets caught in heavy rain or falls into the water, then everything will be over with him. Therefore, they are both good, but each in their own area.
Am I right in understanding that the most functional and convenient to date is the Yubico YubiKey 5 NFC security key?
yes, yubico are currently leading here. i would recommend to test couple different models since they have different workflows (nfc/port)
Not unless a user wanted to have a more useful security key such as using Ledger and Trezor as their 2FA physical key -- in which is much expensive yet the features and use, even the security measures, can be the same level as the YubiKey but on the upper hand when it comes to being a hardware wallet as well (which is really their focus). Hence, if the user were more onto cryptocurrencies and a security-sensitive with his holdings, yet a little wanted to be secured in passwords per se, I guess Ledger and Trezor are better. (just my .69 cents)
Another point in favor of using for authorization purpose HW security keys instead of Trezor (or Ledger) is that the latter has more electronics components inside (display itself and related biasing circuits it requires) thereby wallets in general are less reliable devices, so one shouldn't trust them his/her accounts, could fail at any time.
true but the trezor allows written seed based backup of your 2fa master code (whatever you call it). it can be recreated on another trezor, if needed. once a yubikey is toast you need a another that was already registered to that account/device/whatever, or some other secondary way to get in. then delete the old hardware key and add a new one. whereas a new trezor restored with the seed acts exactly like the old one. plug it in and go.
trezor makes a great backup to a yubikey imo. both have strengths and weaknesses as far as 2FA.
are we talking about the same badusb here? badusb infects the usb chip itself, not the regular firmware of the device. so no approving bad bootloader etc, it just happens without user intervention.. poof the usb controler chip in the trezor is now compromised.. it can make the usb chip into any HID device it wants. it can emulate a keyboard for instance, and send keystrokes. or make itself look like a mass storage device and send a file. all with the trezor otherwise acting fine and with genuine firmware. as its the usb chip thats infected, not the trezor attached to the usb chip.
https://www.wired.com/2014/10/code-published-for-unfixable-usb-attack/
yubikeys dont have a usb controller chip afaik (according to yubikey anyway, its a custom deal as it doesnt need full usb functionality) so its immune.
perhaps my data is out of date?
https://www.wired.com/2014/10/code-published-for-unfixable-usb-attack/
yubikeys dont have a usb controller chip afaik (according to yubikey anyway, its a custom deal as it doesnt need full usb functionality) so its immune.
perhaps my data is out of date?
There are several BadUSB attacks and not all controllers are vulnerable, Trezors have been pretty extensively tested/attacked/audited, none of the attacks to date involve BadUSB so I imagine it's safe in this regard.
also a yubikey doesnt scream "crypto" if you use it in public for 2fa.
I don't know, how many yubikeys were sold in total compared with Trezors?
another advantage a yubikey has over a trezor -- no bad usb infection possible. which i believe (not entirely sure) a trezor is susceptible to.
BadUSB is unlikely, the user would have to be socially engineered to ignore bootloader warnings at every step and even after changing firmware to a malicious one. The warnings about unsigned firmware won't disappear because the bootloader is in a write-protected area. The attack would be easier to conduct if Satoshi Labs was compromised, and afaik multiple people have to sign the firmware.
yubikeys vs trezors? no hard data but id imagine yubikeys far outnumber trezors.. yubikeys can be for work, computer logins, banking, email login etc.
are we talking about the same badusb here? badusb infects the usb chip itself, not the regular firmware of the device. so no approving bad bootloader etc, it just happens without user intervention.. poof the usb controler chip in the trezor is now compromised.. it can make the usb chip into any HID device it wants. it can emulate a keyboard for instance, and send keystrokes. or make itself look like a mass storage device and send a file. all with the trezor otherwise acting fine and with genuine firmware. as its the usb chip thats infected, not the trezor attached to the usb chip.
https://www.wired.com/2014/10/code-published-for-unfixable-usb-attack/
yubikeys dont have a usb controller chip afaik (according to yubikey anyway, its a custom deal as it doesnt need full usb functionality) so its immune.
perhaps my data is out of date?
also a yubikey doesnt scream "crypto" if you use it in public for 2fa.
I don't know, how many yubikeys were sold in total compared with Trezors?
another advantage a yubikey has over a trezor -- no bad usb infection possible. which i believe (not entirely sure) a trezor is susceptible to.
BadUSB is unlikely, the user would have to be socially engineered to ignore bootloader warnings at every step and even after changing firmware to a malicious one. The warnings about unsigned firmware won't disappear because the bootloader is in a write-protected area. The attack would be easier to conduct if Satoshi Labs was compromised, and afaik multiple people have to sign the firmware.
Yubikey is great - I bought my first Yubikey back in 2016, but the problem is that I didn't fasten it to my keychain and ended up losing it after a couple of months. Since then, I regularly use my Trezor as a second factor. If someone is not in the know, then I remind you that any Trezor, in addition to the function of a wallet for cryptocurrencies, can be used as a second factor for authentication. Very convenient indeed.
yes, trezor is a good backup to a yubikey.
of course i like having several yubikeys for just such a situation.. lost or broken although it seems awful tough to break.
also a yubikey doesnt scream "crypto" if you use it in public for 2fa.
another advantage a yubikey has over a trezor -- no bad usb infection possible. which i believe (not entirely sure) a trezor is susceptible to.
i use both btw
Yubikey is great - I bought my first Yubikey back in 2016, but the problem is that I didn't fasten it to my keychain and ended up losing it after a couple of months. Since then, I regularly use my Trezor as a second factor. If someone is not in the know, then I remind you that any Trezor, in addition to the function of a wallet for cryptocurrencies, can be used as a second factor for authentication. Very convenient indeed.
In fact the latest security keys are from the fifth family which is the most advanced among all similar products including those that belong to other brands. I would not recommend to buy Yubico keys belonging to the previous series due to the flaws found in their design. DYOR. Below are a few sources for your start.
https://www.csoonline.com/article/2914645/security-flaw-allows-pin-bypass-in-yubikey-neo.html
https://nakedsecurity.sophos.com/2019/06/17/yubico-recalls-fips-yubikey-tokens-after-flaw-found/
When you see something like that theres always a thought "well this one is reported, but what if other ones just not yet"
but they probably done full revision of all current lineup I found other security keys
Yubico YubiKey 5 NFC
Yubico Yubikey 5C
Yubico YubiKey 5 Nano
CryptoTrust OnlyKey
Thetis Fido U2F Security Key
Thetis FIDO U2F Security Key with Bluetooth
Google Titan Security Keys
Kensington Verimark Fingerprint Key
but since I haven't yet had any experience with security keys it's hard for me to know which one is the best.
Am I right in understanding that the most functional and convenient to date is the Yubico YubiKey 5 NFC security key?
Yubico YubiKey 5 NFC
Yubico Yubikey 5C
Yubico YubiKey 5 Nano
CryptoTrust OnlyKey
Thetis Fido U2F Security Key
Thetis FIDO U2F Security Key with Bluetooth
Google Titan Security Keys
Kensington Verimark Fingerprint Key
but since I haven't yet had any experience with security keys it's hard for me to know which one is the best.
Am I right in understanding that the most functional and convenient to date is the Yubico YubiKey 5 NFC security key?
Yubico proved to be a leader in the field. The first three are different in form-factor/type of USB terminal/NFC presence, DYOR.
theres also new keys with fido2 https://www.yubico.com/products/security-key/
I found other security keys
Yubico YubiKey 5 NFC
Yubico Yubikey 5C
Yubico YubiKey 5 Nano
CryptoTrust OnlyKey
Thetis Fido U2F Security Key
Thetis FIDO U2F Security Key with Bluetooth
Google Titan Security Keys
Kensington Verimark Fingerprint Key
but since I haven't yet had any experience with security keys it's hard for me to know which one is the best.
Am I right in understanding that the most functional and convenient to date is the Yubico YubiKey 5 NFC security key?
Yubico YubiKey 5 NFC
Yubico Yubikey 5C
Yubico YubiKey 5 Nano
CryptoTrust OnlyKey
Thetis Fido U2F Security Key
Thetis FIDO U2F Security Key with Bluetooth
Google Titan Security Keys
Kensington Verimark Fingerprint Key
but since I haven't yet had any experience with security keys it's hard for me to know which one is the best.
Am I right in understanding that the most functional and convenient to date is the Yubico YubiKey 5 NFC security key?
yes, yubico are currently leading here. i would recommend to test couple different models since they have different workflows (nfc/port)
I found other security keys
Yubico YubiKey 5 NFC
Yubico Yubikey 5C
Yubico YubiKey 5 Nano
CryptoTrust OnlyKey
Thetis Fido U2F Security Key
Thetis FIDO U2F Security Key with Bluetooth
Google Titan Security Keys
Kensington Verimark Fingerprint Key
but since I haven't yet had any experience with security keys it's hard for me to know which one is the best.
Am I right in understanding that the most functional and convenient to date is the Yubico YubiKey 5 NFC security key?
Yubico YubiKey 5 NFC
Yubico Yubikey 5C
Yubico YubiKey 5 Nano
CryptoTrust OnlyKey
Thetis Fido U2F Security Key
Thetis FIDO U2F Security Key with Bluetooth
Google Titan Security Keys
Kensington Verimark Fingerprint Key
but since I haven't yet had any experience with security keys it's hard for me to know which one is the best.
Am I right in understanding that the most functional and convenient to date is the Yubico YubiKey 5 NFC security key?
I read up news, Trezor hardware wallet already has further expanded ability with a secure and comfortable two-factor authentication.
Trezor reserve as a hardware security U2F with backup/recovery functions (seed/mnemonic phrase)[1]
disclaimer: i don't use it, you can read manual setting up trezor as 2fa hardware[2] with your own risk
[1]. https://wiki.trezor.io/U2F
[2]. https://wiki.trezor.io/User_manual:Two-factor_Authentication_with_U2F
Trezor reserve as a hardware security U2F with backup/recovery functions (seed/mnemonic phrase)[1]
disclaimer: i don't use it, you can read manual setting up trezor as 2fa hardware[2] with your own risk
[1]. https://wiki.trezor.io/U2F
[2]. https://wiki.trezor.io/User_manual:Two-factor_Authentication_with_U2F
very cool, but how practical is this tho? trezors are huge comparing to the rest of the devices in the segment
This can be the main selling point imho.
I would buy it even if it had have only one single features from its current numerous set i.e. ability to deliver user's password via interface unapproachable by malware. No one wants his main password to be stolen.
I bought two samples of devices (one of them as backup) and didn't regret that because deep and calm sleeping was always my priority.
they claim its immune to badusb and such, which is a necessity if youre plugging it into untrusted systems.
https://www.yubico.com/blog/yubikey-badusb/
of course DYOR
trezor can do this too but who wants what is obviously a crypto wallet on their key chain.
I've been reading this topic and was thinking "why on earth would somebody buy this, since the hardware wallets can handle the job?" when I've finally read this.
Yep. This can be the main selling point imho.
I still believe that hardware wallets for day-to-day transactions should not have big amounts of coins on them (the big amounts can stay on another hardware or paper wallet in a safe), but they could still attract the eyes.
This device definitely deserves a second look.
i just picked one of these up (yubikey 5 nfc). using google auth most places still and slowly changing over to yubi wherever i can. now that i know how easy it is, gonna grab some more, mainly the cheaper simple ones just to register as backups.
having my email and such protected by this is a great feeling. i was always worried my google auth token could be compromised during generation (screenshot or such). never happened that i know of but still.
trezor can do this too but who wants what is obviously a crypto wallet on their key chain.
having my email and such protected by this is a great feeling. i was always worried my google auth token could be compromised during generation (screenshot or such). never happened that i know of but still.
trezor can do this too but who wants what is obviously a crypto wallet on their key chain.
Here is a pretty good article explaining the main differences between TOTP and U2F.
Yeah, pretty clear picture explaining U2F authentication with relatively small errors which fail to take account of the fact that public key goes to server's database at the first add of the dongle to user's account. Then it is stored in database forever.
There are also differing views on who generates "nonce" - the server or U2F dongle when registering at service. I have read somewhere that when it comes to Google it is his responsibility to generate that random number (nonce) that triggers private-public keys creation inside U2F stick. At the same time some services say that nonce is generated by U2F dongle. But I think it doesn't matter and arguably depends on the service.
BTW, Google has the option to add two U2F keys to your account.
I've seen Binance, Coinbase and Bitfinex are offering it
https://www.binance.com/en/blog/351376985820852224/You-Can-Now-Use-Hardware-Security-Keys-on-Binance
https://blog.coinbase.com/securing-your-crypto-with-security-keys-and-webauthn-551124b72d8e
https://support.bitfinex.com/hc/en-us/articles/115003616589-Universal-2nd-Factor-U2F-2FA-Setup
But other big ones like Kraken for example are only planning to add this protocol
https://support.kraken.com/hc/en-us/articles/360001363963-Yubikey-and-2FA-device-compatibility
This sounds cool, can we import our google authenticator keys to this authenticator dongle and vice versa? do you have a video on how to use this and what is the price range just curious. If its really affordable and flexible for sure I am gonna buy it, thanks for the info.
If you mean TOTP based key then the answer is nope. But Google has the option to bring to bear U2F protocol and utilize the HW keys like Yubico to authenticate you. It works in following way. When you register you HW-key-dongle at Google it sends the random number to that dongle. Based on that number the last generates private - public keys pair. Then the public key of that pair is send back to Google that assigns it to your ID. Next time when you log in to Google it sends to HW-key the message and waits for outgoing one that must be signed by HW-key using the corresponding private key. After receiving encrypted message Google decrypts it with public key and checks. If everything is correct then you are in.
P.S. I'm using Yubikey5 to log in to my bitcointalk forum account. But this is the other story.
Unlike TOTP with U2F you don't have to share a seed with the server, so it doesn't need to store it and to send it to you, and you don't have to send any symmetric code.
https://blog.trezor.io/why-you-should-never-use-google-authenticator-again-e166d09d4324
I read up news, Trezor hardware wallet already has further expanded ability with a secure and comfortable two-factor authentication.
Trezor reserve as a hardware security U2F with backup/recovery functions (seed/mnemonic phrase)[1]
disclaimer: i don't use it, you can read manual setting up trezor as 2fa hardware[2] with your own risk
[1]. https://wiki.trezor.io/U2F
[2]. https://wiki.trezor.io/User_manual:Two-factor_Authentication_with_U2F
Trezor reserve as a hardware security U2F with backup/recovery functions (seed/mnemonic phrase)[1]
disclaimer: i don't use it, you can read manual setting up trezor as 2fa hardware[2] with your own risk
[1]. https://wiki.trezor.io/U2F
[2]. https://wiki.trezor.io/User_manual:Two-factor_Authentication_with_U2F
This sounds cool, can we import our google authenticator keys to this authenticator dongle and vice versa? do you have a video on how to use this and what is the price range just curious. If its really affordable and flexible for sure I am gonna buy it, thanks for the info.
OP already mentioned that Yubikey 5 (that he uses) supports U2F, so yeah you can use it with Google[1]. It's priced around $45 USD for a single one.
Do check the official website: https://www.yubico.com/product/yubikey-5-nfc
[1] Additional info: https://support.yubico.com/support/solutions/articles/15000006418-using-your-yubikey-with-google
This sounds cool, can we import our google authenticator keys to this authenticator dongle and vice versa? do you have a video on how to use this and what is the price range just curious. If its really affordable and flexible for sure I am gonna buy it, thanks for the info.
So basically, this device is used to manage passwords and OTP (One-Time Password) for 2FA authentication. I read your post and mostly what I understand is it focus more on 2FA. Even though using a authenticator such as google auth and authy are still helpful and those who got your pass and username won't do much unless they can get the OTP in your phone or devices. The Yubikey 5 NFC cost $45 and $100+ if you buy a Yubikey set if someone is interested to buy. The price is from amazon.
.
Jump to: