News for hackers. Stuff that matters.

A comment on 2018 MacBook Pro Review. Parent comment

Re:2018 MacBook Pro Review by Stratoscope on Sunday July 15, 2018 @08:01PM (#17537810)
Lately I've been working at a company that uses YubiKeys for 2FA. You can use a traditional YubiKey, but the YubiKey Nano is especially popular because you can put it in your laptop and leave it there. It barely sticks out at all, just enough that you can touch it and activate the touch sensor. [1]

I started noticing people in meetings with their new MacBook Pros and six inch cords sticking out the side, and on closer inspection, there was a YubiKey Nano plugged in at the end of the cord.

Meanwhile, the folks with ThinkPads or older MacBooks just had a Nano tucked into one of their USB-A ports like it was no big deal.

I know which I would pick.

[1] https://www.amazon.com/dp/B018Y1XXT6/

[ Parent | on HN ]
Re:2018 MacBook Pro Review by pdpi on Sunday July 15, 2018 @08:09PM (#17537837)
I bought myself the full sized Yubikey instead of the nano because I'm very much of the opinion that the inconvenience is a feature, not a bug — do you _really_ want to leave your Yubikey attached to the device that holds your password manager too?

That said, the problem you described is a temporary one — while not as neat as the USB-A variant, there is a USB-C Yubikey Nano. https://www.yubico.com/product/yubikey-4-series/#yubikey-4c-...

[ Parent | on HN ]
Re:2018 MacBook Pro Review by Stratoscope on Sunday July 15, 2018 @08:14PM (#17537850)
That's a great point about not leaving the YubiKey plugged into the laptop all the time. But the company actually suggests that people get a Nano and leave it plugged in for convenience. Maybe that isn't the best security advice!

Thanks for the pointer to the USB-C YubiKey Nano - it looks like a fine solution for the dongle problem.

[ Parent | on HN ]
Re:2018 MacBook Pro Review by chrisseaton on Sunday July 15, 2018 @08:45PM (#17537959)
I don't understand - why don't they just get USB-C compatible YubiKeys if they have USB-C laptops?
[ Parent | on HN ]
Re:2018 MacBook Pro Review by watersb on Monday July 16, 2018 @12:59AM (#17538873)
The company would have to provision and deploy those, and these things take time and money.

You could purchase your own, I suppose.

[ Parent | on HN ]
Re:2018 MacBook Pro Review by derefr on Sunday July 15, 2018 @08:57PM (#17538007)
That's even more funny, because the MBP's touch-bar is essentially the same type of device as the YubiKey—an isolated offboard CPU with its own TPM that can be unlocked with a fingerprint and then asked to encrypt secrets for the host/parent PC. The touch-bar just has more screen.

I'm surprised nobody's hacked the YubiKey app into making use of the touch-bar as the YubiKey "device."

[ Parent | on HN ]
Re:2018 MacBook Pro Review by robto on Sunday July 15, 2018 @09:09PM (#17538056)
Doesn't that kind of defeat the point of the Yubikey? I would think you would want to separate the key and the computer when you yourself are separated from your computer.
[ Parent | on HN ]
Re:2018 MacBook Pro Review by pfranz on Monday July 16, 2018 @12:17AM (#17538745)
The copy on the Yubikey Nano's website says, "designed to remain in port." Removing it is still an option, but it doesn't sound like it's the point of having it.
[ Parent | on HN ]
Re:2018 MacBook Pro Review by jimmywanger on Monday July 16, 2018 @01:28AM (#17538966)
You can also use the fingerprint sensor as a replacement for the ubikey. Which works arguably as well - at least it satisfies the criteria that you separate the key and the computer when you yourself are separated from the computer.
[ Parent | on HN ]
Re:2018 MacBook Pro Review by xur17 on Monday July 16, 2018 @10:50AM (#17541706)
The device still requires a pin for most operations (depending on how it's configured), and locks itself if the wrong pin is used too many times.
[ Parent | on HN ]
Re:2018 MacBook Pro Review by innagadadavida on Monday July 16, 2018 @06:31AM (#17540149)
It’s implemented as a auth mechanism to memento, it might be open sourced at some point.

The reason yubikey doesn’t do this is that it will kill their business and product.

[ Parent | on HN ]
Re:2018 MacBook Pro Review by timdierks on Sunday July 15, 2018 @09:30PM (#17538133)
https://github.com/github/SoftU2F
[ Parent | on HN ]
Re:2018 MacBook Pro Review by Yizahi on Monday July 16, 2018 @04:03AM (#17539534)
How would you change your fingerprint if it is compromised? Yubikey can be swapped at any time.
[ Parent | on HN ]
Re:2018 MacBook Pro Review by megablast on Sunday July 15, 2018 @08:04PM (#17537825)
Yes, I too base my decisions of which laptop to buy based on how a YubiKey looks.
[ Parent | on HN ]
Re:2018 MacBook Pro Review by Stratoscope on Sunday July 15, 2018 @08:11PM (#17537843)
It's not just a cosmetic issue. The people with the six inch cords are leaving them plugged into the laptop all the time as they walk around the building, just like the people with the USB-A ports are leaving their YubiKeys plugged in all the time.

The difference is that if they bump into somebody or something, that dongle is likely to get broken, and it could even damage the USB-C port in the MacBook. That's not going to happen with a Nano plugged directly into a USB-A port.

[ Parent | on HN ]
Re:2018 MacBook Pro Review by glhaynes on Sunday July 15, 2018 @08:43PM (#17537953)
Right, it’s important that the whole world stand still for a decade because of some fucking “YubiKey dongle”.
[ Parent | on HN ]
Re:2018 MacBook Pro Review by llampx on Monday July 16, 2018 @04:39AM (#17539666)
Calm down. It's not just YubiKey. The world isn't moving to USB-C everything for a while yet.
[ Parent | on HN ]