This isn’t strictly a privacy question as a security one, so I’m asking this in the context of individuals, not organizations.
I currently use OTP 2FA everywhere I can, though some services I use support hardware security keys like the Yubikey. Getting a hardware key may be slightly more convenient since I wouldn’t need to type anything in but could just press a button, but there’s added risk with losing the key (I can easily backup OTP configs).
Do any of you use hardware security keys? If so, do you have a good argument in favor or against specific keys? (e.g. Yubikey, Nitrokey, etc)
If you don’t mind, maybe you can answer this question for me. I finally jumped on the Yubikey train recently, added a couple accounts, no problem. But then I noticed apparently I can connect my key to any random install of the authenticator app on any device, and it will show the accounts I have protected with that key.
To me, this means if I lose my key someone can learn a fair bit about who owned that key just from looking at the accounts on their own phone when they find it on the street. Now someone knows I have the account myname@someemailprovider.com (among others) when they didn’t know that before. Etc.
I have googled unsuccessfully to find out if for some reason this is less of a problem than I feel like it is, or if it can be masked somehow, but my keyword choices must have been poor.
Do you have any opinion on this? I googled specifically if it would allow you to set a PIN to unmask that info or similar, but the PIN articles I found seemed to relate to something else.
I’m unfamiliar with how Yubikey works but I thought the FIDO2 protocol was designed to prevent that sort of association. Anyway it doesn’t sound good. Cryptographer’s saying (by Silvio Micali): “A good disguise should not reveal the person’s height”.
Oh yeah it clearly seems a bad idea to me, which is why I’m assuming error on my part. 100% though I took an unrelated phone, installed the yubico app, slapped my nfc yubikey up to it, and could see my accounts listed.
Oh I misunderstood what you were describing but yeah, it doesn’t sound good. It sounds like the key is supposed to be an SSO credential for multiple phones? Maybe there’s a way to set it up differently. You might ask their support.
I probably described it poorly.
It’s nothing that exotic. I use it as MFA for a few different accounts as I assume anyone who has one does. :)
Using one easy example, I have myname@anemailprovideryouveheardof.com set up and I can clearly see “myname@anemailprovideryouveheardof.com” as a linked account on my yubikey on any device. I can’t do anything with it, but I see my username in the format shown above, and the one time code counting down.
I don’t actually know why I haven’t gone to their support - hadn’t thought about it for awhile until reading this thread, so that’s a good suggestion and will do.
Yeah it would be preferable IMHO if you had to enroll a newly installed app with username and password in addition to the key.
I think y’all are talking about different things. Some sites (like google) have direct yubikey support where you plug the key into the device and what you’re talking about isn’t an issue
Other sites don’t have direct support, but allow you to use any authenticator app which is what you’re talking about with using the yubico authenticator app/key combination. Plugging it into a yubico authenticator app on any device will show the codes
Unfortunately I don’t have an answer for a way to protect those other accounts. I guess the hope is that if you lose it, it can’t be tied to your accounts, just the websites themselves