https://blog.fefe.de/?ts=99ccc8dc [l] I’ve long been a fan of dubious security manufacturers because I think it’s an absolute disservice to talk about security and then fail to deliver on it or talk down security gaps. In my opinion, the code from security companies in particular should be techni…

The firmware version is listed on their product pages. The FIPS keys are the unpatched version 5.4, but the standard 5-keys are on the latest 5.7. The FIPS keys, as I understand it, are designed to adhere to certain regulations for government use, and offer no security benefits over the standard ke…

It was disappointing that they did not take the vulnerability seriously enough to replace affected keys. The fact that they are now selling vulnerable stock is probably illegal under consumer protection laws (if true).

I would prefer they just offer replacements to anyone who wants one but I think their explanations make sense. According to the researchers, any attempt to exploit this vulnerability would require significant resources and knowledge. The attacker would need physical possession of the YubiKey, Secu…

Frankly, that is a bullshit explanation from Yubico. This vulnerability fundamentally undermines the guarantees which a YubiKey is designed to provide (i.e. it no longer functions as advertised). It should not be unreasonable to expect Yubico to voluntarily replace vulnerable keys or to be legally r…

[image] phnx: This vulnerability fundamentally undermines the guarantees which a YubiKey is designed to provide I don’t buy that. The attacker needs to have physical control of your device and even then “a successful attack cannot be accomplished at will” according to NIST. Not only that but …

I feel like we are looking at it from the perspective of two distinct guarantees a YubiKey provides. One of those is phishing resistance, but the reality is that you could achieve equally robust phishing protection with software-based passkeys or other public-key cryptography. Having hardware-back…

[image] phnx: It may not matter to everyone’s threat model but for some people it does I just tend to believe, considering the complexity of the vulnerability, that people that would likely be targeted with it are not keeping old yubikeys in use anyway but I see your point. [image] phnx: …

The fact that some people are defending Yubico in this situation is mind blowing.

Honestly have no clue what you are trying to say here…uhh yeah, torture will break a lot of people security model?

Yes. If you are caught with your secured gadget and your yubikey, you can be coerced to open it, no need to get the expert. [image] anon29374801: Honestly have no clue what you are trying to say here… Also, it is possible that I have yet to be caffeinated and may be rambling like an idiot …

Given this, what are the alternatives? From my understanding we have the google titan, which doesn’t allow you to delete passkeys once you’ve created them, and the nitrokey, who has been called out by the graphene devs for spreading misinformation

Privacy Guides Community

YubiKey is still selling old stock with vulnerable firmware

Questions

phnx November 18, 2024, 1:52pm 14

YubiKeys are unfortunately still the best option, just make sure you are buying a key with firmware version 5.7 or later. They support the most modern CTAP versions which for example enable the key itself to require a FIDO2 PIN be used.

Best Security Key(s) besides YubiKeys?

Topic		Replies	Views
How safe is it to use a year old yubikey? Questions hardware	5	616	November 4, 2024
Cloudflare and Yubico offer yubikeys for $10 Off Topic	11	2139	November 16, 2022
Yubikey firmware is not upgradeable Off Topic hardware	3	919	February 20, 2024
Nitrokey 3 (Hardware Security Key) Tool Suggestions	3	1983	January 21, 2024
KEY-ID \| FIDO security keys General	2	585	October 8, 2023

Privacy Guides

Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.

Privacy Guides is a non-profit, socially motivated website that provides information for protecting your data security and privacy.

We do not make money from recommending certain products, and we do not use affiliate links.

Knowledge Base

Private Web Browsers

Top VPN Providers

Privacy-Respecting Services

Software Recommendations

More Resources

YubiKey is still selling old stock with vulnerable firmware

Related topics