Cybersecurity

5856 readers

122 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected]

Notable mention to [email protected]

founded 2 years ago

MODERATORS

kid

[email protected]

Sanity check: Yubikeys and password shares (reddthat.com)

submitted 3 months ago by [email protected] to c/cybersecurity

15 comments fedilink hide all child comments

I've been thinking about getting a couple of Yubikeys for a partner and myself, but we share certain accounts. While I would love to have the Yubikey 5 that can store TOTP, that seems like it could be problematic for shared accounts.

Would using the cheaper Yubico Security Keys to unlock Bitwarden Premium vaults, that use a Shared Organization, be a better/more sane option than trying to sync up TOTP secrets every time a new shared account gets added? Any other critiques or suggestions?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 3 months ago (8 children)

All it takes to sync TOTP is to manually set up the secrets on all keys.

Keeping a second factor in a password manager makes it a single factor, doesn’t it?

[–] [email protected] 2 points 3 months ago (5 children)

So let's say I'm at work, I set up NewAccount to use Yubikey A. Partner has Yubikey B and isn't nearby. How would I share or retrieve that secret key later? My understanding is that's not possible if it's stored on the key, but maybe I'm wrong.

[–] girsaysdoom 2 points 3 months ago (2 children)

If you're just storing the password on the key then, no you can't get it unless you have the key. The main usage (arguably) for a yubikey is the FIDO2 auth method where you add those keys as MFA methods. That would allow access using either key.

[–] [email protected] 1 points 3 months ago

I think of that like putting multiple things in the same basket, but putting two locks on that basket.

[–] [email protected] 1 points 3 months ago

Thanks, that's kind of what I was thinking.

Sounds like a YK5 might still be a viable use case, but I'd have to do a deeper analysis of what account 2FA secrets would need to be shared versus which can be relegated onto individual keys and safely lose that "always accessible anywhere" trait.

load more comments (2 replies)

load more comments (4 replies)