Sanity check: Yubikeys and password shares (reddthat.com)

submitted 4 months ago by Telorand@reddthat.com to c/cybersecurity@sh.itjust.works

15 comments fedilink hide all child comments

I've been thinking about getting a couple of Yubikeys for a partner and myself, but we share certain accounts. While I would love to have the Yubikey 5 that can store TOTP, that seems like it could be problematic for shared accounts.

Would using the cheaper Yubico Security Keys to unlock Bitwarden Premium vaults, that use a Shared Organization, be a better/more sane option than trying to sync up TOTP secrets every time a new shared account gets added? Any other critiques or suggestions?

you are viewing a single comment's thread
view the rest of the comments

[-] Cort@lemmy.world 4 points 3 months ago

You may already be aware, but a vulnerability has been recently documented on those.

https://lemmy.zip/post/22094344

[-] Telorand@reddthat.com 3 points 3 months ago

I'm aware. It doesn't affect Yubikeys with firmware v5.7 and above, which should be any keys bought in May onward (June to be safe).

I don't have one yet, so when I buy a key, it should be safe from that particular attack; I'll RMA it if it's the unpatched firmware version.

[-] WolfLink@sh.itjust.works 1 points 3 months ago

The attacker would need physical possession of the YubiKey, Security Key, or YubiHSM, knowledge of the accounts they want to target and specialized equipment to perform the necessary attack. Depending on the use case, the attacker may also require additional knowledge including username, PIN, account password, or authentication key.

Yeah that’s not a dealbreaker IMO

this post was submitted on 04 Sep 2024

13 points (93.3% liked)

Cybersecurity

5880 readers

20 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 2 years ago

MODERATORS

kid@sh.itjust.works

Lanky_Pomegranate530@midwest.social