Yubikeys

[mekelek]

What exactly happens if your Yubikey stops working or you lose it?
Is there a way to recover/order a new one with the same key/timer or you need to go through all the services you used it on to remove it?

nvm just checked it on their site, so the answer is the second.
well that's inconvenient

 

[Amelith Nargothrond]

What exactly happens if your Yubikey stops working or you lose it?
Is there a way to recover/order a new one with the same key/timer or you need to go through all the services you used it on to remove it?

nvm just checked it on their site, so the answer is the second.
well that's inconvenient

Yubikeys are write-only devices. Can't read anything out of them to back them up. This is the price you have to pay for top hardware security, you have to be careful, pay attention and leave "the girls" for later. This is what pro work means.

But, just in case, you should implement your systems so that you can recover from a lost Yubikey. Unless you really dream with your eyes opened all day, this should not happen that often...

 

[Amelith Nargothrond]

@askmark
Just as a reference, this is how my login screen looks like (smart card auth with Yubikey):

Spoiler: Yubikey Windows Login

No third party services, just the good old DC and the Yubikey.
Secures your RDP connection as well (as Yubikeys can be used remotely via RDP), so in short, you and your users are secured

You can enforce this further, to lock the workstation automatically if the Yubikey is not inserted, etc.

Using the Yubikey, the users don't have to remember complex passwords, the PIN of the Yubikey will suffice. It's awesome!

P.S. If you need a helping hand setting it up, let me know

 

[enaph]

Thought about it, but an Authenticator app suits my needs better.

Same here.

 

[TheJokerz]

I have been looking into these! I think I am going to take that plunge and get one now! Any suggestions on which works best?

 

[Amelith Nargothrond]

I have been looking into these! I think I am going to take that plunge and get one now! Any suggestions on which works best?

It's a matter of what are you going to use it for, so you need to dig a little bit more to find out for yourself. You first need to understand the differences as well (and their correspondent use-cases), as some of them are really for the tech savvies.
There are hardware/feature differences between all models: Compare YubiKeys | Strong Two-Factor Authentication for Secure Logins | Yubico

I'm using all 3 models I have (U2F, 4, Neo) for different stuff. But I'm guessing that for general usage, the Neo (with NFC) would be an excellent choice, as you can replace your soft tokens (2FA software authenticator apps) with the key-based 2FA. The key can be read by both the phone (via NFC) and the desktop app itself. And do a lot more things with the key in the process

 

[TheJokerz]

@Amelith Nargothrond Great thank you for the information!

 

[Amelith Nargothrond]

@Amelith Nargothrond Great thank you for the information!

There are other of useful links on previous posts, might want to take a look at those as well.
You're welcome

 

[Amelith Nargothrond]

@askmark

Just remembered something, a very important troubleshooting advice (from my experience, it will make your life so much easier):

• If you will implement smart card auth with the Yubikey at your clients,
• and if you enforce the use of smart cards for interactive logins for all users with a gp,
• and if your admin account gets locked out for whatever reason

... you will not be able to login to the domain controller, not even in safe mode, to fix your problem, as you will be asked for a smart card (the MSDN articles, where safe mode bypasses smart cards, do not apply for Yubikeys). But you will be able to login (and troubleshoot) with the "directory services repair mode", as this will bypass the smart card requirement, even for Yubikeys. But you have to be able to get there with Server 2016 and 2012 before disaster strikes, so you have to enable the display of the boot menu at every startup, so you can select the "ds repair mode" (instead of safe mode). That's a 30 sec added delay (by default).

Also worth mentioning that Yubikeys (or any other smart cards) will not work in ILO, iDRAC etc. KVMs (I only use HP and DELL servers, so I can't really speak for the others, but nonetheless I doubt others support it).

With this in mind, you can (power) reset your dc and get to the boot menu without any further complications. Obviously, this is a security risk you will have to take, but I assume the servers are locked away from general public use. A user and password will still be required to login.

To do this, run this code in a cmd with admin privileges before anything else, on the dc:

bcdedit /set {bootmgr} displaybootmenu yes

Also, to best protect RDP or RDS, for admin accounts (or important accounts), also tick the "smart card is required..." in the user's properties account tab of the ad user's and computers list, as it will further harden the way a user authenticates to RDP/RDS, even if you enforce the use of a smart card by a gp by all users.

 

[Amelith Nargothrond]

@Parsh , @askmark and anyone else interested:

I promised a short review of the Yubikey, but I found something much better written (compared to my abilities to write an article and my English) and well documented as well which fully reflects my opinions about the Yubikey:
Understanding the YubiKey: A Distilled Introduction - Webb.codes

And I found this link inside this article, which is pretty much awesome. It lists products and services that support USB tokens: USB Dongle Auth List

A similar website: Two Factor Authentication Tutorials | Turn on 2FA

Enjoy

 

[Myriad]

Understanding the YubiKey: A Distilled Introduction - Webb.codes

Good article !
Thanks for posting .

I was going to raise a hypothetical issue about the installation that was the target for Stuxnet
and whether Yubikey might have offered some additional protection .

But I don't want to hijack this thread , so maybe I should split it off to a new thread ?
Any thoughts ?

 

[Amelith Nargothrond]

Good article !
Thanks for posting .

I was going to raise a hypothetical issue about the installation that was the target for Stuxnet
and whether Yubikey might have offered some additional protection .

But I don't want to hijack this thread , so maybe I should split it off to a new thread ?
Any thoughts ?

It's (also) about Yubikeys, I don't mind continuing here
Interesting topic!

 

[ParaXY]

I almost bought a Yubikey for my secure desktop build but then I decided on using Windows Hello with the Logitech BRIO camera!

 

[Amelith Nargothrond]

I almost bought a Yubikey for my secure desktop build but then I decided on using Windows Hello with the Logitech BRIO camera!

Windows Hello and smart card (PIV) authentication are completely different "animals". Yubikey supports both. The Logitech camera and the facial recognition in Hello might be good enough for home users, although anything but safe (it's just convenient, like a fingerprint reader on the phone).

Hello for business is closer to security, as it uses cryptographic technologies to authenticate the user (uses key-based or certificate-based authentication), which the "home edition" Hello does not.

 

[ParaXY]

Windows Hello and smart card (PIV) authentication are completely different "animals". Yubikey supports both. The Logitech camera and the facial recognition in Hello might be good enough for home users, although anything but safe (it's just convenient, like a fingerprint reader on the phone).

Hello for business is closer to security, as it uses cryptographic technologies to authenticate the user (uses key-based or certificate-based authentication), which the "home edition" Hello does not.

To be honest I haven't looked into Hello for business but thanks for mentioning it as I'm always keen on making things more secure yet practical at the same time.

Has Hello for home use been bypassed/hacked yet? When I was looking into it even twins couldn't bypass so this is something I'm curious on.

Also, physical security is important in anyone's setup and luckily for me there is no-one that can try and access my desktop when I am not around at home and try to trick Windows Hello into logging in!

 

[Amelith Nargothrond]

I think Hello business requires AD.
Honestly, I have no idea if Hello for home was bypassed, haven't looked into it, basically because I will probably never use it, I have many "secrets" to protect even at home.

Also, from what I do remember after reading about Hello (home) a few months ago, is that password authentication is still available if Hello fails to log you in, and there's no way to enforce it. If it is true, then it's pointless, I can hack your PC in 5 minutes with a USB stick with all the Hellos in the world activated at the same time on your PC.

It's well known that biometrics-based security is easily hackable. A very good article about this comes in mind: Biometrics Are Coming, Along With Serious Security Concerns

Yubikeys, on the other hand (if used properly), are extremely safe. My home PC's are mostly joined to my domain, except 1 (the one in the kitchen, but accessing resources from the domain still requires a Yubikey). My wife has one as well, she can't log in without one. I haven't managed to hack myself yet, my workstations, and I tried. A lot. All I did, in the end, is to completely lock myself out, which is the expected behavior.

 

[maniac2003]

Interesting comments @Amelith Nargothrond. I'm using a Yubikey as a extra layer for my LastPass login but that's it.
It certainly could be useful for my employer, I'll keep an eye on it.

 

[Amelith Nargothrond]

Interesting comments @Amelith Nargothrond. I'm using a Yubikey as a extra layer for my LastPass login but that's it.
It certainly could be useful for my employer, I'll keep an eye on it.

If you have the NFC version, you can also protect many 2FA soft-token based accounts (with the Yubikey Authenticator), or directly the Yubikey's FIDO U2F with google (for example).

 

[maniac2003]

If you have the NFC version, you can also protect many 2FA soft-token based accounts (with the Yubikey Authenticator), or directly the Yubikey's FIDO U2F with google (for example).

I have the 'old' standard Yubikey, it's nearing it's 5th birthday

 

[ParaXY]

Also, from what I do remember after reading about Hello (home) a few months ago, is that password authentication is still available if Hello fails to log you in, and there's no way to enforce it. If it is true, then it's pointless, I can hack your PC in 5 minutes with a USB stick with all the Hellos in the world activated at the same time on your PC.

Yes, if the Hello login fails them you have the option to login with a password or any other method you have configured (like PIN).

Can you expand on how you would hack my PC in 5min with a USB stick with Hello enabled/configured?

I'm interested in your approach and how I can mitigate against this kind of attack.