Privacy

31931 readers

632 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

[email protected]

Are there FLOSS-friendly versions of YubiKey? (lemmy.world)

submitted 4 months ago by [email protected] to c/[email protected]

19 comments fedilink hide all child comments

I rarely use my smartphone and find it a bit annoying to have to use it for 2FA through apps. I wish to get physical passkeys that will allow me to login to my laptop.

I have heard of YubiKey although I haven't given it any serious consideration since it is closed source. (My super-tin-foiled friend who introduced me to this world of privacy taught me to never trust a closed-source solution... _long _ story).

Are there any FLOSS versions of Yubikey? Can they be used to log into a Linux machine? Or for banking?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 4 months ago

Verifying the Security Claim of 2FA Devices

The claim that using OTP tokens and Yubikeys compromises your security and privacy is completely false.

Let's look at this in more detail.

Arguments against concerns:

Limited information:

Device serial numbers and purchase details are stored by the retailer, but this does not provide access to your accounts. Serial numbers themselves cannot be used for hacking.

Cryptographic protection:

Yubikey and OTP tokens use strong cryptographic methods such as HMAC-SHA1, RSA and ECC, which make OTP generation extremely secure and tamper-resistant.

Physical access:

Authentication using these devices requires physical access to the device. This means that an attacker must physically possess your Yubikey or OTP token in order to be authenticated.

No transfer of personal data:

These devices do not transmit or store personal user information on third-party servers. They generate one-time codes locally and send them only to the target service.

Phishing protection:

Yubikey with FIDO U2F and FIDO2 support protects against phishing because the codes are domain specific and cannot be used on phishing sites.

Additional arguments:

Reducing dependency on passwords:

Using 2FA devices reduces the risk of accounts being compromised, even if the primary password is stolen.

Integrated protection systems:

When combined with other security measures, such as two-factor authentication with SMS or mobile apps, OTP tokens and Yubikeys create multi-layered protection that makes it harder to hack.

Convenience and speed:

These devices simplify the login process by providing instant and secure authentication without the need to remember complex passwords.

Conclusion:

While purchasing a 2FA device may leave traces in merchants' databases, the risks are minimal compared to the security they provide. Yubikey and OTP tokens significantly increase the level of security for your accounts, especially when combined with other security methods. Therefore, the claim that using these devices compromises your security and privacy is untrue.