Privacy Guides

I would argue that if the attacker has physical possession of my yubikey, that alone means the accounts tied to it are vulnerable. While the information isn't technically wrong, I feel like that headline is misleading and this isn't as big of a deal as some would like to make it out as.

Knowledge of the account is an obvious caveat. Yubikey-based MFA is an added layer of protection for accounts, so any kind of attack against MFA assumes the attacker already knows which account to target.

It's like saying "our door lock is flawed, but the attacker would need to have knowledge of the door".

The cost and complexity is what's noteworthy and is more relevant. Although attack cost and complexity usuallu goes down with advances in tooling and research. So it may be a good idea to plan a progressive retirement of affected keys.

Cheaper just to beat you until you give them what they want.

The fact that this happened is surprising in general, but not super practical.

What’s the big deal? A: It affects other types of hardware which also used these crypto libraries. Some are easier to address than others.

It’s due to a cryptographic library implementation in a controller used in the yubikey. It’s a third party controller, and this isn’t exclusive to yubikeys either, a shitload of other stuff uses the same controller and is likely vulnerable to the same attack.

Also, the attack requires around $10k worth of equipment and physical access to the yubikey, so while a valid attack vector, it’s also not something to get into a panic about.

While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven’t tested other devices using the microcontroller, such as the SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contains the same vulnerability.

Both. The cryptographic library in question is also used in other cryptographic applications too, so it's a huge mess.

Which is why I'm now questioning why I even bought them to begin with. Any time a security flaw is found I need to spend another $50-60. Seem crazy and wasteful.

https://old.reddit.com/r/privacytoolsIO/comments/ibajud/is_it_possible_to_make_a_security_key_by_myself/

But there's open FIDO2 sticks around. One would be SoloKeys. Then there's other competitors, though not open.

But if you mean, simple authentication via stick, sure. Or you could do your own thing, watching via udev for the MAC ID, write a file somewhere sensitive and look in your login script if it exists.