Ok, here's the deal on the "YubiKey cloning attack" stuff:
Yes, a way to recover private keys from #YubiKey 5 has been found by researchers.
But the attack *requires*:
👉 *physically opening the YubiKey enclosure*
👉 physical access to the YubiKey *while it is authenticating*
👉 non-trivial electronics lab equipment
I cannot stress this enough:
✨ In basically every possible scenario you are safer using a YubiKey or a similar device, than not using one. ✨
> The attacker would need physical possession of the YubiKey, Security Key, or YubiHSM, knowledge of the accounts they want to target, and specialized equipment to perform the necessary attack. Depending on the use case, the attacker may also require additional knowledge including username, PIN, account password, or authentication key.
This is not to say this is not a big deal: it does make information security people reevaluate certain assumptions related to YubiKeys.
But it is a big deal to a very, very limited number of people.
If this was really a big deal for you, you'd know already and would not need anyone to tell you so.
And even *if* it was a big deal for you, then it would still not be a *practical* attack – just something to ponder and discuss with your infoseccy peers.
So, keep calm and use security keys! 🔑
@rysiek What kind of device wouldn't be vulnerable to this?
If they opened my smartphone while I'm having an encrypted communication over Signal, they would be able to retrieve the private key somehow.
@tonicfunk @rysiek I suspect many people are susceptible to a "well equipped" "evil maid" with "physical access" without any technology involved at all...
Oh wait, what were we discussing again?
OTP Token, TOTP token, Replace your mobile authenticator with secure hardware OTP token! Easily programmed via NFC. Designed to use with Google, Facebook, Dropbox, GitHub, Wordpress, Office 365, Azure MFA etc.
@rysiek this is a $5 wrench problem. (Xkcd:538)
An adversary would beat your with a $5 wrench until you logged in rather than go through with this attack.
@rysiek oh hey look it's this post I boosted appearing already in the wild as predicted!
https://haunted.computer/@Dio9sys/113052816378220682
(Thank you for being the voice of calm)
security researchers: "Here is poc for a new vulnerability. In order to actually exploit this vulnerability, you have to put two computers in the upper troposphere, make sure they both have the exact same brand of hard drive, turn them both on at the same time so the rng matches and then, once you have all that handled, you could abuse the rng to make an alert happen on the other computer. Right now it takes 257 tries to work but, with more research, we might be able to get it working more often than that as long as there's no cosmic rays bouncing off the RAM." News coverage about the vuln: "NEW 0-CLICK VULNERABILITY FOUND THAT CAN LEAD TO REMOTE CODE EXECUTION. RESEARCHERS SAY STABLE EXPLOIT CODE COMING SOON"
@josh @rysiek And don't be fooled by THAT. There is actually no such thing as a quantum entanglement, and they are going to try to sell you "quantum cryptography" even though it has EVERY classic characteristic of snake oil and is actually just security through obscurity.
(See my bio and pinned toots for pointers on the first point. You can run my Python program that defies what quantum physicists claim is impossible.)
@rysiek someone mentioned in another thread that the big group that you could be vulnerable to now is cops. They can, and quite likely, do meet all three of your points if they're after you fairly or otherwise. (i.e. they've arrested you and/or seized your equipment including the key)
Doesn't take away your point though.
@beeoproblem it does change the threat model somewhat, but honestly, cops have better ways of getting into an online account than doing a side-channel attack using electromagnetic emanation analysis on a stripped YubiKey.
Like, talking to the service provider.
And as I said later in that thread, if that is really a big issue for you, you'd already know it is, and plan accordingly.
@rysiek Posting the obligatory XKCD Here https://xkcd.com/538/
Before an attacker will execute that plan, they will either use physical force or bribery.
@claudiacaesaris well, not quite.
YubiKey and similar devices do make certain promises about the impossibility if extracting private keys without destroying the device.
This research could show a path to attacks that break that promise.
So complaining about this is valid – but the context of that is super important.
@dan613 while this is *technically* true, a domestic abuser will have so many other more direct ways to gain access to the survivor's services, that making such a point to non-technical people who are not trained in threat modelling is – I would argue – actively harmful.
It might convince some survivors to not use YubiKeys or other security keys, thus opening themselves to orders of magnitude more likely and easier ways of gaining such access.
Please be careful with such takes.
Michał "rysiek" Woźniak · 🇺🇦
grin
xyhhx 🔻 (plz hire me)
Alexander Bochmann
small, primitive, wingless
vifon
Brendan B.
Devil 
Gustavo
Wolf480pl
Haelwenn /элвэн/ 
Jes 
Andrew Douglass
tonic 
furicle
Firstyear
Joshua M. Clulow
fops
Matthew 
faraiwe
Ian
Soulfire The Wolf 
Faisal Misle
IAintShootinMis
amy
lunacatuwu
Chesapeake
J. "Henry" Waugh
Carlos Solís
Josh “Space Phrasing” Cubert
Barry Schwartz 🫖
MaybeMyMonkeys
Alexandre Oliva (moved to @lxo@gnusocial.jp)
Mack Hall
Bee O'Problem 
Andrew
chrysn
Christoph Petrausch
Claudia Caesaris 🏳️⚧️🥚
Dan Neuman 🇨🇦