Physical Keys (YubiKey, etc)

By jnelsoninjax
in Smart Home, Network & Security

 Share

Recommended Posts

Grand Master

adrynalyne

Posted
Posted (edited)
18 minutes ago, jnelsoninjax said:

Is there any difference in the physical keys made by Google or YubiKey, etc? Do they all function the same way?

They might provide some overlap features, but no. Google’s key is more limited (not talking about connectivity), and the last I checked, just as expensive as Yubikey. Plus I don’t trust Google with something like that. 

Grand Master

jnelsoninjax

Posted
  • Author
Posted
3 hours ago, adrynalyne said:

They might provide some overlap features, but no. Google’s key is more limited (not talking about connectivity), and the last I checked, just as expensive as Yubikey. Plus I don’t trust Google with something like that. 

How about Solokeys? They are billing themselves as open source. Paging @BudMancan I get your insight?

Grand Master

adrynalyne

Posted
Posted (edited)
9 minutes ago, jnelsoninjax said:

How about Solokeys? They are billing themselves as open source.

I don’t know enough about them to say either way. 
 

I guess I should clarify my last comment. Yubikey has different types of keys. Their full-featured one has more features. Their FIDO/2 keys are more comparable to what Google and Solokey offers. AFAIK, Yubikey firmware also offers some open source, but I don’t know to what extent. 
 

 

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

What is your planned use for whatever key you might happen to get?

 

I have a hard time justify their use for most things to be honest.  What is the scenario that you will use it?  To auth to some site on your phone or your phone itself even - so your really going to carry this key with you, along with your phone?  And pop it out every time you need to do xyz?

 

Are you going to use it to log into your computer - in your house?  Really?  Or you going to just leave it plugged into your PC all the time?

 

Now if you were going to use it say access your bank website that you only access on rare occasions, or maybe to access your crypto exchange account.

 

Don't get me wrong - they do have their use for sure.. But without the scenarios you plan on using it..

 

Keeping in mind that all security is always going to be something extra that has to be done.. The more "extra" that thing is - the less likely it will ever be used.  Or will be circumvented for ease of use that defeats the whole purpose.

 

Give you a perfect example of this in a work environment, with IT professionals.. So to login to the laptops you needed tiks card, got specific certs on it, etc. Because the laptop drive is encrypted.  What your suppose to do is carry said card in your wallet.  And place into the laptop when your using it, then say when you go home and putting the laptop in your bag where it might be stolen.. Or really even say you were going out for a business lunch or something and leaving your laptop at the desk.  The card should go with you.. 

 

Guess what happens.. Users just left the card in their laptops 24/7 - shoot they even cut off the end of the card so it didn't stick out so they could just slide it into their bags when leaving.  So they leave said laptop bag in their car, and it gets stolen, or leave it in the uber or bus.. The whole point of the 2fa auth token is defeated because it was "too much" effort to take it in and out ;)

 

So I ask - what is the scenario of use?  Are you going to put the key in a safe place - and only use it to access your crypo/bank account which is something you don't do every day?  Or you plan on using it to auth to say neowin ;)  Which you do every day, or multiple times a day.. So the thing ends up sticking out the usb port of your PC 24/7/365 ;)

 

My 2fa is my phone.. I have it with my 24/7/365 - other than when sleeping (right next to me) or taking a shower - again most likely on the sink in the bathroom with me..  What are you going to do with this key?  Are you going to carry it with you on a chain around your neck.. And put it into a device, and take it out the device every time you need to auth?

Grand Master

adrynalyne

Posted
Posted (edited)
30 minutes ago, BudMan said:

What is your planned use for whatever key you might happen to get?

 

I have a hard time justify their use for most things to be honest.  What is the scenario that you will use it?  To auth to some site on your phone or your phone itself even - so your really going to carry this key with you, along with your phone?  And pop it out every time you need to do xyz?

 

Are you going to use it to log into your computer - in your house?  Really?  Or you going to just leave it plugged into your PC all the time?

 

Now if you were going to use it say access your bank website that you only access on rare occasions, or maybe to access your crypto exchange account.

 

Don't get me wrong - they do have their use for sure.. But without the scenarios you plan on using it..

 

Keeping in mind that all security is always going to be something extra that has to be done.. The more "extra" that thing is - the less likely it will ever be used.  Or will be circumvented for ease of use that defeats the whole purpose.

 

Give you a perfect example of this in a work environment, with IT professionals.. So to login to the laptops you needed tiks card, got specific certs on it, etc. Because the laptop drive is encrypted.  What your suppose to do is carry said card in your wallet.  And place into the laptop when your using it, then say when you go home and putting the laptop in your bag where it might be stolen.. Or really even say you were going out for a business lunch or something and leaving your laptop at the desk.  The card should go with you.. 

 

Guess what happens.. Users just left the card in their laptops 24/7 - shoot they even cut off the end of the card so it didn't stick out so they could just slide it into their bags when leaving.  So they leave said laptop bag in their car, and it gets stolen, or leave it in the uber or bus.. The whole point of the 2fa auth token is defeated because it was "too much" effort to take it in and out ;)

 

So I ask - what is the scenario of use?  Are you going to put the key in a safe place - and only use it to access your crypo/bank account which is something you don't do every day?  Or you plan on using it to auth to say neowin ;)  Which you do every day, or multiple times a day.. So the thing ends up sticking out the usb port of your PC 24/7/365 ;)

 

My 2fa is my phone.. I have it with my 24/7/365 - other than when sleeping (right next to me) or taking a shower - again most likely on the sink in the bathroom with me..  What are you going to do with this key?  Are you going to carry it with you on a chain around your neck.. And put it into a device, and take it out the device every time you need to auth?

I’m not OP but I will give you my uses for it. 
 

My Yubikey stays with me at all times, on my key chain. I use it where I can, but mostly to add additional protection to LastPass, GitHub repos, and Gmail accounts. I have several keys that are setup for these sites. In addition, I carry my Authenticator info on my keys, so I can install Yubikey Authenticator safely on any machine and if the key isn’t plugged in, the cycling OTPs aren’t present. A FIDO/2 key isn’t going to be as useful to someone like me. 
 


 

 

Grand Master

jnelsoninjax

Posted
  • Author
Posted
55 minutes ago, BudMan said:

What is your planned use for whatever key you might happen to get?

 

I have a hard time justify their use for most things to be honest.  What is the scenario that you will use it?  To auth to some site on your phone or your phone itself even - so your really going to carry this key with you, along with your phone?  And pop it out every time you need to do xyz?

 

Are you going to use it to log into your computer - in your house?  Really?  Or you going to just leave it plugged into your PC all the time?

 

Now if you were going to use it say access your bank website that you only access on rare occasions, or maybe to access your crypto exchange account.

 

Don't get me wrong - they do have their use for sure.. But without the scenarios you plan on using it..

 

Keeping in mind that all security is always going to be something extra that has to be done.. The more "extra" that thing is - the less likely it will ever be used.  Or will be circumvented for ease of use that defeats the whole purpose.

 

Give you a perfect example of this in a work environment, with IT professionals.. So to login to the laptops you needed tiks card, got specific certs on it, etc. Because the laptop drive is encrypted.  What your suppose to do is carry said card in your wallet.  And place into the laptop when your using it, then say when you go home and putting the laptop in your bag where it might be stolen.. Or really even say you were going out for a business lunch or something and leaving your laptop at the desk.  The card should go with you.. 

 

Guess what happens.. Users just left the card in their laptops 24/7 - shoot they even cut off the end of the card so it didn't stick out so they could just slide it into their bags when leaving.  So they leave said laptop bag in their car, and it gets stolen, or leave it in the uber or bus.. The whole point of the 2fa auth token is defeated because it was "too much" effort to take it in and out ;)

 

So I ask - what is the scenario of use?  Are you going to put the key in a safe place - and only use it to access your crypo/bank account which is something you don't do every day?  Or you plan on using it to auth to say neowin ;)  Which you do every day, or multiple times a day.. So the thing ends up sticking out the usb port of your PC 24/7/365 ;)

 

My 2fa is my phone.. I have it with my 24/7/365 - other than when sleeping (right next to me) or taking a shower - again most likely on the sink in the bathroom with me..  What are you going to do with this key?  Are you going to carry it with you on a chain around your neck.. And put it into a device, and take it out the device every time you need to auth?

Honestly I was just asking because I read an article on Gizmodo that suggested that we should be using them as opposed to the cell phone, so I am not sure that I am going to buy any, it was mainly just a question for my own information.

Grand Master

Yusuf M. Veteran

Posted
  • Veteran
Posted
On 30/04/2021 at 16:04, jnelsoninjax said:

Honestly I was just asking because I read an article on Gizmodo that suggested that we should be using them as opposed to the cell phone, so I am not sure that I am going to buy any, it was mainly just a question for my own information.

It's great for security and arguably the best in terms of what's generally available. The thing is, it's overkill for the vast majority of typical use cases. Online banking and cryptocurrency exchange accounts come to mind but so few banks even offer 2FA, let alone support for physical security keys. Personally, I'd only use it for cryptocurrency stuff. In most cases, using an authenticator app is good enough.


With that said, I don't think there's anything wrong with using it out of curiosity. SoloKeys seems like a good one because it uses open source firmware.

Grand Master

adrynalyne

Posted
Posted
12 hours ago, Yusuf M. said:

It's great for security and arguably the best in terms of what's generally available. The thing is, it's overkill for the vast majority of typical use cases. Online banking and cryptocurrency exchange accounts come to mind but so few banks even offer 2FA, let alone support for physical security keys. Personally, I'd only use it for cryptocurrency stuff. In most cases, using an authenticator app is good enough.


With that said, I don't think there's anything wrong with using it out of curiosity. SoloKeys seems like a good one because it uses open source firmware.

Agreed on it being overkill for a lot of people. I do everything overkill though.

Grand Master

neufuse Veteran

Posted
  • Veteran
Posted
12 hours ago, Yusuf M. said:

It's great for security and arguably the best in terms of what's generally available. The thing is, it's overkill for the vast majority of typical use cases. Online banking and cryptocurrency exchange accounts come to mind but so few banks even offer 2FA, let alone support for physical security keys. Personally, I'd only use it for cryptocurrency stuff. In most cases, using an authenticator app is good enough.


With that said, I don't think there's anything wrong with using it out of curiosity. SoloKeys seems like a good one because it uses open source firmware.

few banks offer 2FA? I haven't come across one that didn't in years... even local banks around me that are smaller have it

Grand Master

adrynalyne

Posted
Posted
2 minutes ago, neufuse said:

few banks offer 2FA? I haven't come across one that didn't in years... even local banks around me that are smaller have it

Yeah but do they offer FIDO/2 ?


OP I think was only looking at these keys. 

Grand Master

jnelsoninjax

Posted
  • Author
Posted
6 minutes ago, neufuse said:

no, but I was replying to this line "but so few banks even offer 2FA, let alone support for physical security keys."

My credit union has OTK that they send via SMS whenever you call and talk to them, and 2FA via SMS on the mobile app.

Grand Master

neufuse Veteran

Posted
  • Veteran
Posted
45 minutes ago, jnelsoninjax said:

My credit union has OTK that they send via SMS whenever you call and talk to them, and 2FA via SMS on the mobile app.

My bank is so secure they wont let you change anything about your account unless you do it at the original branch.... problem for me is the original branch closed  😆 every time I call in for something they want a password and the location I took out my first account at.... which is a bit ridicilous... and to close an account you have to visit the original branch.. maybe that is something to stop you from closing it? lol....

Grand Master

spaceelf

Posted
Posted
On 30/04/2021 at 08:52, jnelsoninjax said:

Is there any difference in the physical keys made by Google or YubiKey, etc? Do they all function the same way?

I have both.  Googles can't be used by default with Windows 10, but it obviously works for websites.  They function similarly but you can set a pin on the Yubikey (and promptly forget whatever the hell it was heh.)

 

Checking if the Yubikey can work for logins now.  I really don't know, but they have some software for it.

Grand Master

inactive

Posted
Posted (edited)

Just a small comment ill add about YubiKey's...

 

those who want to use these basically need two of them at minimum. one for general use and one for a backup stored in a secure location. that helps ensure you won't get locked out of your Google account for example since you register both keys to the account. so even if you lose one, you can always use the backup to sign-in to the Google account, remove the lost key, then you can simply buy another key and register that to the account and you will now have two keys registered once again.

 

p.s. I just have two of the standard/basic YubiKey's. but currently they are a bit pricier than what I paid for mine not all that long ago as for a couple of the basic ones it's $49 now where as I got two at a discount for $30. because for the price I paid it was nice peace of mind, but at $49 I could easily see how some might have second thoughts about using them as at that price it's a little steep. NOTE: YubiKey's work on Linux Mint but not by default. but it's easy enough to get them working as you just copy and paste the text from... https://github.com/Yubico/libu2f-host/blob/master/70-u2f.rules to a file (just load up Text Editor(Xed)) named '70-u2f.rules' and save it to "/etc/udev/rules.d/" then reboot. works on Chrome/Firefox (may work on other browsers but I never tested). but I noticed if a person is running their browser in Firejail (sandbox), to sign into ones Google account for example, you got to run the browser normally, sign-in into ones Google account with the YubiKey, then exit the browser, reload it in the Firejail sandbox and you will be fine here since it's using the cookie from previous session.

Edited by ThaCrip
Grand Master

Mindovermaster Global Moderator

Posted
  • Global Moderator
Posted
49 minutes ago, neufuse said:

My bank is so secure they wont let you change anything about your account unless you do it at the original branch.... problem for me is the original branch closed  😆 every time I call in for something they want a password and the location I took out my first account at.... which is a bit ridicilous... and to close an account you have to visit the original branch.. maybe that is something to stop you from closing it? lol....

I'd move to a new bank, if I were you...

Grand Master

+Tantawi Subscriber²

Posted
  • Subscriber²
Posted
2 hours ago, neufuse said:

My bank is so secure they wont let you change anything about your account unless you do it at the original branch.... problem for me is the original branch closed  😆 every time I call in for something they want a password and the location I took out my first account at.... which is a bit ridicilous... and to close an account you have to visit the original branch.. maybe that is something to stop you from closing it? lol....

Is your bank located in Egypt? :D that experience is awfully familiar to one I had...

Grand Master

Mindovermaster Global Moderator

Posted
  • Global Moderator
Posted
Just now, adrynalyne said:

Why because it’s secure? 

Not saying it's secure, just saying you can't do anything unless you come to the main branch.

 

21 minutes ago, neufuse said:

not exactly easy when you have a mortgage there, that's an expensive move

Oh, that says a lot...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Microsoft releases PowerToys v0.100.1, fixes a bug that made remapped keys misbehave

      By Ivan Jenic · Posted

      Microsoft releases PowerToys v0.100.1, fixes a bug that made remapped keys misbehave by Ivan Jenic Microsoft just released PowerToys v0.100.1, a patch update that addresses several stability and behavior issues found in v0.100.0. The v0.100.0 patch was a significant update for PowerToys, as it introduced all sorts of new features and additions, such as a rebuilt Shortcut Guide, a Command Palette Extension Gallery, webcam overlay support in ZoomIt, and more. However, the v0.100.0 version also introduced some bugs and stability issues. And now, Microsoft is addressing these issues in the new patch. The most impactful fix in this release perhaps is in Keyboard Manager, where remapped modifier keys were being delivered as system-key events, causing unexpected behavior in apps. The clearest example of this was Alt-to-Backspace remaps, deleting whole words instead of a single character. So, if you thought there was an issue with your keyboard, Microsoft just confirmed that it was PowerToys. Beyond the Keyboard Manager fix, v0.100.1 also addresses several other issues. It fixes a bug with Power Display that was preventing monitors from waking from standby correctly. Additionally, the new update patches Quick Access crashes on launch, and resolves a Shortcut Guide crash that occurred when switching between sidebar sections. Here’s the full changelog: Color Picker Fixed a bug where the main Color Picker window could appear inside the zoomed-in picker view Command Palette Fixed Run history initialization in AOT builds Fixed a bug where the Performance Monitor dock item could show ??? after restart Fixed the Hibernate command using the Sleep icon Limited the "pin to dock" dialog to displays where the dock is enabled Keyboard Manager Fixed modifier keys remapped to non-modifier keys being delivered as system-key events, which caused unexpected behavior in apps such as Alt-to-Backspace deleting whole words Power Display Fixed a bug where selecting On in the monitor power-state control did not wake a monitor from standby Fixed built-in display detection and brightness control on dual-GPU laptops where the internal panel is driven by the discrete GPU PowerToys Run Fixed VS Code Workspaces discovery after VS Code moved recently opened workspace data to shared storage Quick Access Fixed Quick Access flyout crashes caused by unhandled XAML exceptions during launch or page navigation Shortcut Guide Fixed a crash when navigating between Shortcut Guide sidebar sections Fixed number-key rendering in shortcut manifests and added a Postman shortcut manifest Updated bundled shortcut manifests to use the literal number-key token so number keys render correctly across apps ZoomIt Fixed a race condition in audio initialization for ZoomIt video recording You can download PowerToys v0.100.1 from the official GitHub releases page.
    • OBS Studio 32.2.0 Beta 2

      By Copernic · Posted

      OBS Studio 32.2.0 Beta 2 by Razvan Serea OBS Studio is software designed for capturing, compositing, encoding, recording, and streaming video content, efficiently. It is the re-write of the widely used Open Broadcaster Software, to allow even more features and multi-platform support. OBS Studio supports multiple sources, including media files, games, web pages, application windows, webcams, your desktop, microphone and more. OBS Studio Features: High performance real time video/audio capturing and mixing, with unlimited scenes you can switch between seamlessly via custom transitions. Live streaming to Twitch, YouTube, Periscope, Mixer, GoodGame, DailyMotion, Hitbox, VK and any other RTMP server Filters for video sources such as image masking, color correction, chroma/color keying, and more. x264, H.264 and AAC for your live streams and video recordings Intel Quick Sync Video (QSV) and NVIDIA NVENC support Intuitive audio mixer with per-source filters such as noise gate, noise suppression, and gain. Take full control with VST plugin support. GPU-based game capture for high performance game streaming Unlimited number of scenes and sources Number of different and customizable transitions for when you switch between scenes Hotkeys for almost any action such as start or stop your stream or recording, push-to-talk, fast mute of any audio source, show or hide any video source, switch between scenes,and much more Live preview of any changes on your scenes and sources using Studio Mode before pushing them to your stream where your viewers will see those changes DirectShow capture device support (webcams, capture cards, etc) Powerful and easy to use configuration options. Add new Sources, duplicate existing ones, and adjust their properties effortlessly. Streamlined Settings panel for quickly configuring your broadcasts and recordings. Switch between different profiles with ease. Light and dark themes available to fit your environment. …and many other features. For free. At all. OBS Studio 32.2.0 Beta 2 changelog: Beta 2 Changes Fixed a CI deployment issue. There are no application changes since Beta 1. 32.2 New Features Replaced add source dropdown with new dialog [Warchamp7] Improved FPS selector UX [jcm93] Added missing file support for filters [exeldro] Added ability for plugins to set custom icons for new source types [cg2121] Included .webp files when adding a directory to Image Slide Show source [TarunCore] Added copy paste functions to frontend API [exeldro] Added filter to compose SDR into HDR [jpark37] Added delete as a hotkey to delete sources on macOS [PatTheMav] Added dynamic bitrate support to multitrack video [lexano-ivs] 32.2 Changes Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav] This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions. Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7] Added theming for checked QToolButtons [glikely] Improved OpenGL performance slightly on low-end machines [kkartaltepe] Set minimum size for color source to 1 pixel [exeldro] Added minimum width to spinboxes [Warchamp7] Disallowed overwriting the crash handler [sebastian-s-beckmann] Applied process mitigation policies for Windows [notr1ch] Adjusted description of multitrack video [jhnbwrs] Changed new capture devices to use fallback frame rate by default [PatTheMav] Improved DLL loading behavior on Windows [notr1ch] Limited multitrack video config to Custom service [PatTheMav] 32.2 Bug Fixes Fixed OAuth and dock state save corruption [PatTheMav] Fixed group bounds not resizing when removing items [howellrl] Fixed canvas mixes not being restored after video reset [dsaedtler] Fixed some erroneous crashes during shutdown [Warchamp7] Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop] Fixed color of controls dock output buttons in System theme [shiina424] Fixed virtual camera reset failures [stephematician] Fixed potential crash when user discards changes in the settings window [suogesi] Fixed incorrect return value in virtualcam filter [xtfo] Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7] Fixed properties hint icon spacing [Warchamp7] Fixed potential crash when a video device reconnects on macOS [jcm93] Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina] Fixed obs_canvas_get_video_info returning incorrect framerate [dsaedtler] 32.2 Deprecations Deprecated obs_properties_add_button [sebastian-s-beckmann] Download: OBS Studio 32.2.0 Beta 2 | Portable | ARM64 | ~200.0 MB (Open Source) View: OBS Studio Homepage | Other Operating Systems | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Microsoft is building an AI datacenter that "uses less water than a fast food restaurant"

      By Slugsie · Posted

      Is a fast food restaurant a good metric to compare against?
    • Grand Theft Auto VI pricing revealed alongside Ultimate Edition and pre-loading details

      By LoneWolfSL · Posted

      Grand Theft Auto VI pricing revealed alongside Ultimate Edition and pre-loading details by Pulasthi Ariyasinghe Last week, Rockstar revealed Grand Theft Auto VI pre-orders will be starting soon, and just a day ahead of that, now the studio has announced the official pricing for the highly anticipated game. This has been a hotly debated topic among fans and industry veterans for a long time, considering the game is expected to be the biggest entertainment product launch ever. The confirmed pricing for the Grand Theft Auto VI standard edition is $79.99, which Rockstar says gives access to the "single-player experience set in the biggest, most immersive evolution of the series yet." This follows what most of our readers thought would happen with the pricing too. At the same time, a $99.99 Grand Theft Auto VI: Ultimate Edition has been confirmed as well, which lands with "an exclusive collection of premium vehicles, weapons, apparel, and action threaded across all aspects of Jason and Lucia’s story." Pre-ordering will also give fans extra bonuses, including a Vintage Vice City Pack of cosmetic items as well as a free month of GTA+. Head to the official website of the game here to check out all the cosmetic rewards the Ultimate Edition and pre-orders bring. Interestingly, the studio does not mention Grand Theft Auto VI multiplayer at all in today's announcement. Perhaps this will arrive later, following the campaign launch, or the studio is keeping that reveal for a later date. Digital pre-orders for Grand Theft Auto VI will begin on June 25, 2026, at midnight local time across regions for Xbox Series X|S and PlayStation 5. The title is slated to launch on November 19 on those same platforms. Pre-loading for Grand Theft Auto VI will kick off on November 12, giving players a week to get the game ready on their consoles. As for the physical edition, Take-Two has confirmed that this will be available without a disc, with the box only containing a download code inside. This will be purchasable starting November 12, giving players who take this route time to pre-load the title as well.
    • Politically funny images of the World

      By +Edouard · Posted

  • Recent Achievements

    • One Year In
      OHI Accounting earned a badge
      One Year In
    • First Post
      Almohandis earned a badge
      First Post
    • Rookie
      DaviKar went up a rank
      Rookie
    • Dedicated
      HidekoYamamoto94 earned a badge
      Dedicated
    • One Month Later
      timbobit earned a badge
      One Month Later

  • Popular Contributors

    1. 1
      +primortal
      474
    2. 2
      +Edouard
      172
    3. 3
      PsYcHoKiLLa
      122
    4. 4
      Michael Scrip
      83
    5. 5
      Xenon
      72
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!