News for hackers. Stuff that matters.
Re:Pressing YubiKeys by f0ff on Friday October 02, 2020 @07:25PM (#24668063)
I'd hazard saying that the purpose of a YubiKey is to provide two factor authentication. A YubiKey acts as an item, posession of which implies identity. When you allow for the YubiKey to be activated without human interaction, it's moved from domain of posession into the domain of knowledge - identifying party needs to know where to knock, not to possess they key. It's no better than appending the URL at the end of your password.

If you allow for a YubiKey, or any other physical artifact in that matter, to be remotely invoked it negates its utility as an authentication factor in the physical domain.

Re:Pressing YubiKeys by Dylan16807 on Saturday October 03, 2020 @06:08AM (#24670929)
It depends on what protects the key. If the problem is being unable to duplicate it, you could protect remote access with a different YubiKey or some other second factor.

And the setup in the article isn't even remote access. If the only way it can be triggered is a local button press, you're golden.

Re:Pressing YubiKeys by inlined on Saturday October 03, 2020 @01:35AM (#24669806)
If they made the uri SSL with fixed certs it’s still a “something I have” factor IMO.