Source
r/yubikey•
SameDaySS

How important is the company behind the ****Key?

Hi, I'd like to get 2-yubikey but saw FIDO2 ones on Amazon for 1/4 of the price. Other than price, I'll probably spring for Yubi as the company has been around for a while.

But, seeing that under 20-bucks option begs the question. How much involvement does the key-company have with the security? Not on the topic of programming skills and encryption levels. yeah, I know that's important but ...

Does the key-company get to see anything that goes on with the key when in use? I mean does it call home while plugged into phone or PC?

OR.

Once the key is purchased and I assume, activated, is that the last the key-company has access to it or any data?

Trusting the key working is one thing but how much trust must we have in the company behind it?

Thanks

Posted Mar 18, 2023, 4:03 PM UTC

717
shmoosr•

Well, this is a Yubikey centric subreddit, so I think you're going to find a significant amount of support for Yubico, myself included.

Having said that, I think a good place to start is the https://fidoalliance.org. You can search certifications and partnerships there and see what each authenticator level constitutes.

14
SameDaySSOP•

Thanks, I understand about the possible favorable-bias when asking here.

I thought someone using Yubikey might have done the research and could give me an outline of what control a manufacturer has over my security and data.

I looked at that link but it is way above my pay-grade to grasp.

0
GrandWizardZippy•

They have no access or control over your data. Your not saving data outside of cryptographic onthe yubikey anyway.

2
SameDaySSOP•

OK, thanks. I appreciate your straightforward response to the question asked.

It is so damned hard to get just that these and is is heartening to see when it happens. :)

1
Simon-RedditAccount•

  1. Phoning home is extremely unlikely. Ordinary keys contain only a secure MCU that generates the secret key and performs operations with it. No way to establish a connection with the company’s servers (at least until you’re not a subject of targeted attack. If you deliberately were given the rigged key, everything is possible).

  2. What’s more important is the proper implementation of secure element. Correct algorithm implementation, without flaws. Cryptographically secure RNG. A write-once MCU program memory. Disabled JTAG etc. Proper fuses set up. Resistance to side-channel attacks. Tamper protection.

It’s not hard to create a FIDO2/U2F implementation in hardware. What’s really hard - to create proper and secure implementation. If you see cheap price, that most likely means that some corners were cut. Yes, Yubico uses not-very-expensive chip, but the price also includes proper design and R&D as well.

Anyway, it’s up to you and your threat model. Who are you? An ordinary Joe or a person with a position in a vital company? How do you value your data and your accounts? How much are you willing to invest in protection? etc…

Personally I’d purchase two $25(ish) Yubico Security keys, or wait for another Cloudflare-like promo to get them at $10/each.

Other brands may be OK for you, but something really cheap (less that $~15) should raise the flag…

9
SameDaySSOP•

secret key and performs operations with it.

Surely though it must be communicating with the end-website. If it can "talk" via the browser or direct get/put to the login-site, it could talk to home too.

2
Simon-RedditAccount•

Consider it as a keyboard. Most keyboards cannot connect anywhere, but they can talk to browser.

In fact, U2F device presents itself as HID device: https://fidoalliance.org/specs/u2f-specs-1.0-bt-nfc-id-amendment/fido-u2f-hid-protocol.html

> it must be communicating with the end-website

This is not true. The browser communicates with the end website. And it's also the browser who decides, whether to use your Yubikey/Google Titan/Solokey, or software U2F implementation. Open this website in any modern browser: https://webauthn.io/ . It will work without any hardware key (although it will ask if you have one).

It also means, that if your browser is rigged by malware, you're doomed.

Check this for more info: https://webauthn.guide/

5
Starfox-sf•

I think your tinfoil hat is malfunctioning. FIDO/FIDO2 is a standard that allows a website to exchange unique cryptographic keys with a “key” in the users possession, with the browser acting as a middle man. All three need to support and implement the standard to work.

Yubico is a member of the FIDO alliance, along with other companies. Even before FIDO they were in the business of using hardware-based 2FA in a different way (the “short touch” method). If you aren’t willing to trust that a company in the business of making such 2FA devices is doing something like “phoning home” I think you should look to other 2FA implementations.

— Starfox

2
SameDaySSOP•

I think your tinfoil hat is malfunctioning

No need to be condescending and rude. It is a legitimate question to ask.

If you aren’t willing to trust

Please don't extrapolate without facts to base it upon. I was asking about the functionality and security of using any such device and not declaring a stand against Yubico. I don't know them and I don't know the companies behind any other such devices. I thought asking here would be a good place to start my edification. I made no allegations.

If I knew the answers I would not be asking as the entire process is new to me. I never go into anything without understanding what I might be getting myself into. Prudent people do that.

I think your Troll-warning device and yubi-fanboi are malfunctioning. ;)

1
SameDaySSOP•

Also, searching the Yubi site I have not found a Privacy Statement. Not saying it is not there, but I have not yet found it.

1
Individual_Brick5537•

Cheapest yubikey is $25.

You have to consider the feature set, the manufacturer (trustworthy?), and the seller (trustworthy?).

3
SameDaySSOP•

But is that $25 FIDO2 compliant? No point buying last years technology. ;)

-1
Individual_Brick5537•

Yep.

Comparison link: https://www.yubico.com/us/store/compare/

Scurity Key C and Security Key NFC are both FIDO2 compliant: https://www.yubico.com/us/store/compare/security-key-c-nfc-by-yubico-black,security-key-nfc-by-yubico-black/

3
SameDaySSOP•

OK, thanks, but I am still looking for their Privacy Statement.

-3
Individual_Brick5537•

? What do you mean? Yubico's? You didn't mention the privacy statement at all above.

You can click on "Privacy" at the bottom of any of the Yubico websites and it will bring you to details about how they handle privacy.

3
NeuralFantasy•

The cheapest Security Key is very much FIDO2 compatible. For me it is the best key: cheapest and has the strongest possible protocols. I used it on various websites and with SSH. Works perfectly.

As for your question. Yubikeys are not the cheapest but they are of very high quality. They are tamper resistant and well manufactured. You get what you pay for.

3