• 0 Posts
  • 98 Comments
Joined 1 year ago
cake
Cake day: June 29th, 2023

help-circle










  • I’m not sure I necessarily agree. Your assessment is correct, but I don’t really think this situation is security by obscurity. Like most things in computer security, you have to weight the pros and cons to each approach.

    Yubico used components that all passed Common Criteria certification and built their product in a read-only configuration to prevent any potential shenanigans with vulnerable firmware updates. This approach almost entirely protects them from supply-chain attacks like what happened with ZX a few months back.

    To exploit this vulnerability you need physical access to the device, a ton of expensive equipment, and an incredibly deep knowledge in digital cryptography. This is effectively a non-issue for your average Yubikey user. The people this does affect will be retiring and replacing their Yubikeys with the newest models ASAP.








  • They very likely dont have read or write access to the files on your device.

    However, they probably do have the ability to remotely wipe the device. This feature is typically used in enterprise if a phone or laptop is lost or stolen to prevent bad actors from getting access to the data stored on the device.


  • Not only does password rotation not add to security, it actually reduces it.

    Assuming a perfect world where users are using long randomly generated strong passwords it’s a good idea and can increase security. However, humans are involved and it just means users change their passwords from “Charlie1” to “Charlie2” and it makes their passwords even easier to guess. Especially if you know how often the passwords change and roughly when someone was hired.

    Ideally, your users just use a password manager and don’t know any of their credentials except for the one to access that password manager.

    If they need to manually type them in, password length should be prioritized over almost any other condition. A full sentence makes a great unique password with tons of entropy that is easy to remember and hard to guess.


  • I get this too. However, you’ll usually be able to tell the professionals your end goal during the quoting process and if your requirements are reasonable, they’ll work with you.

    If they won’t do that, then you get to ask yourself the next question:

    • Do they have a good reason to refuse? (safety [either theirs or yours], regulations, etc)

    If not, then you can just refuse the quote and work with someone else.

    More often than not, the professionals know what they’re doing and will be able to work around your requirements, and if they can’t, they’ll have competitors that can.