<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 3/23/20 3:53 PM, Sabri Berisha
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:391186719.103251.1585003992366.JavaMail.zimbra@cluecentral.net">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div style="font-family: tahoma, new york, times, serif;
font-size: 10pt; color: #000000">
<div>Hi,</div>
<div><br data-mce-bogus="1">
</div>
<div>In my experience, yubikeys are not very secure. I know of
someone in my team who would generate a few hundred tokens
during a meeting and save the output in a text file. Then
they'd have a small python script which was triggered by a
hotkey on my macbook to push "keyboard" input. They did this
because the org they were working for would make you use
yubikey auth for pretty much everything, including updating a
simple internal Jira ticket.</div>
<div><br>
</div>
<div data-marker="__SIG_PRE__"><br>
</div>
</div>
</blockquote>
<p>One of the things that got lost in the Webauthn stuff is that
passwords per se are not bad. It's passwords being sent over the
wire. In combination with reuse, that is the actual problem.
Webauthn supposedly allows use of passwords to unlock a local
credential store, but it is so heavily focused dongles that it's
really hard to figure out for a normal website that just want to
get rid of the burden of remote passwords.</p>
<p>Mike<br>
</p>
</body>
</html>