Are hardware security keys worth it? If so, which to pick?

This isn't strictly a privacy question as a security one, so I'm asking this in the context of individuals, not organizations.

I currently use OTP 2FA everywhere I can, though some services I use support hardware security keys like the Yubikey. Getting a hardware key may be slightly more convenient since I wouldn't need to type anything in but could just press a button, but there's added risk with losing the key (I can easily backup OTP configs).

Do any of you use hardware security keys? If so, do you have a good argument in favor or against specific keys? (e.g. Yubikey, Nitrokey, etc)

Andromxda ,

I recommend NitroKeys. They are very secure and open-source.

KillingTimeItself ,

im preferential of the concept of just using a USB drive, and some basic scripting automation to trigger it.

Thats just me hating anything moderately proprietary though.

Nebula224 ,
@Nebula224@lemmy.ml avatar

How would this work? Is there an open source project available?

KillingTimeItself ,

i'm honestly not to sure how one would go about it, i know one of my friends has done it. I would assume there is at least one open source project for this type of thing. Realistically i can't imagine it would be that hard, there are probably writeups on people doing it already. In the most simplistic form you're keeping spicy private keys on an encrypted flash drive. That way they're a physical hardware item, but also physically isolated. Though you would absolutely be in a bit of a bind if you ever lost it. Realistically, changing the key and it's encryption will solve that problem though.

I've recently thought of doing similar things using forward secrecy keys stored on the flashdrive itself so that way it's always different. Similar immediate security risk there, but again changing the key is the solution. Theoretically you could also do a two part key system, where you store a portion of it on your system, and the rest on the drive, so that way in the event of compromise, they only have a portion of the key. And they still need the other part in order to do anything.

scripting wise, it should be pretty simple, you plug in the drive, automount it, rip the key out, stuff it to where it needs to go, and then remove the drive. Always make sure you have secondary backups though, whether written down or stored somewhere. Losing accounts is no fun.

I'm not a security researcher or expert though, there are definitely smarter people out there that have already talked about this kind of thing at length.

ChallengeApathy ,

I'm not an expert but the way I see it is this: if you're tech-savvy and use common sense, they're not necessary, as a 2FA app with TOTP along with random, strong passwords should be enough. I still use both for most things, only securing more sensitive stuff with a physical key.

However, having one definitely can't hurt, and if you're passionate about cybersec, it'd be kinda strange if you didn't have one.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • privacy@lemmy.ml
  • test
  • worldmews
  • mews
  • All magazines
    •