Verifying the Security Claim of 2FA Devices

The claim that using OTP tokens and Yubikeys compromises your security and privacy is completely false.

Let's look at this in more detail.

Arguments against concerns:

1. Limited information:

• Device serial numbers and purchase details are stored by the retailer, but this does not provide access to your accounts. Serial numbers themselves cannot be used for hacking.

2. Cryptographic protection:

• Yubikey and OTP tokens use strong cryptographic methods such as HMAC-SHA1, RSA and ECC, which make OTP generation extremely secure and tamper-resistant.

3. Physical access:

• Authentication using these devices requires physical access to the device. This means that an attacker must physically possess your Yubikey or OTP token in order to be authenticated.

4. No transfer of personal data:

• These devices do not transmit or store personal user information on third-party servers. They generate one-time codes locally and send them only to the target service.

5. Phishing protection:

• Yubikey with FIDO U2F and FIDO2 support protects against phishing because the codes are domain specific and cannot be used on phishing sites.

Additional arguments:

1. Reducing dependency on passwords:

• Using 2FA devices reduces the risk of accounts being compromised, even if the primary password is stolen.

2. Integrated protection systems:

• When combined with other security measures, such as two-factor authentication with SMS or mobile apps, OTP tokens and Yubikeys create multi-layered protection that makes it harder to hack.

3. Convenience and speed:

• These devices simplify the login process by providing instant and secure authentication without the need to remember complex passwords.

Conclusion:

While purchasing a 2FA device may leave traces in merchants' databases, the risks are minimal compared to the security they provide. Yubikey and OTP tokens significantly increase the level of security for your accounts, especially when combined with other security methods. Therefore, the claim that using these devices compromises your security and privacy is untrue.

There are suitable alternatives listed in other comments, but it is worth noting that none of them will support the proprietary YubiKey authentication protocol.

This isn't a big deal if all of the applications you want to use it with support FIDO2/WebAuthn authentication, but YubiKeys support both.

(Disclaimer: I work there)

Check out @nitrokey. we make Open Source software and hardware security keys that have pretty similar functionality with Yubikeys.

#Fido #PGO and in progress #PIV

I have a onlykey. Been using it for probably 5 years now. Not sure why they aren't more common.

For my own understanding, what potential dangers are there using a Yubikey as opposed to an open source key?

Might want to check out Mooltipass. I got mine from tindie and they're worth a look IMO.

Solokeys

I believe solokeys are open source. I use a solo v1 for sudo, ssh, and two factor websites. They either went out of business or are basically defunct as I understand it, but you can pick them up on crowd supply. I wouldn't get the v2, supposedly they had problems and that's why they shut down. You likely won't see updates, but they do function for what you're looking for. There are some that are shaped like a small thumb drive and some that sit almost flush with a USB port. Some have nfc, which is useful for phones. Buy at least 2 though, and register both for everything, because you don't want to lock yourself out of something.

There is SoloKey, which is an open-source version of YubiKey. Although full disclosure, I haven't actually tried it myself so I can't really vouch for it personally.

I believe that NitroKeys are open-source. The New Oil did a video covering them.