Google: Security Keys Neutralized Employee Phishing

Re:Google: Security Keys Neutralized Employee Phishing by ehsankia on Tuesday July 24, 2018 @12:13AM (#17598070)

What do you mean you need both? The two in 2-factor is password + ubikey, not laptop + ubikey.

If someone gets your laptop with ubikey inside, they can't do anything without your password. And the whole point of a physical second factor is to basically limit the 99.9% of the people (mostly from other countries and cities) that have no physical access to you from hacking you.

[ Parent | on HN ]

Re:Google: Security Keys Neutralized Employee Phishing by tptacek on Tuesday July 24, 2018 @12:25AM (#17598106)

It's "Yubikey", not "ubikey". The Nano and Y4 keys do more than U2F; they also generate and store RSA keys. They aren't just 2FA devices; they're also small HSMs.

[ Parent | on HN ]

Re:Google: Security Keys Neutralized Employee Phishing by GordonS on Wednesday July 25, 2018 @06:38AM (#17608231)

If I have access to someone else's laptop with a nano key plugged into it, can I access all the SSH key files stored on the key, or are they also protected from access somehow?

[ Parent | on HN ]