Hacker News Reader

Comment by not2b | Hacker News Reader

Good job describing the breakin to the laptop, but I was disappointed when I read that after bootup it auto-connects to the corporate network, nothing like Okta or Yubikey or something else needed as an authentication step. That made things too easy and seems like bad security practice.

View on HN

Pin + Yubikey. Not certain whether you can use a Yubikey without a pin, but I think it's important to specify: something you have plus something you know.

The reason: the newer yubikeys don't ever leave the usb port. Mine is almost impossible to remove. And if this attack is based on a stolen laptop then chances are the yubikey comes with it.

https://www.amazon.com/dp/B07HBDX2CM

The standard trick that I've seen used for removing a Yubikey Nano is threading a paperclip through that little hole, and tugging.

Incidentally, you can also use a paperclip (a chain, even) to trigger a touch without having to touch the key directly.

> Not certain whether you can use a Yubikey without a pin

You can choose, no pin / pin once after plugging in / pin on every use.

Yubikey is not something popular in enterprises. At least not the ones I worked for. I only heard about it because Google uses it (or something similar).

Amazon uses it

My company uses Okta Verify. So when the bad guy tries to connect the hacked laptop to the corporate network VPN, the person who was assigned that laptop gets a "Login attempt, is that you?" message on their cell phone (if the push method is used) or is prompted for the 6-digit code, and it doesn't connect until confirmation is received. Unless someone can defeat it somehow.

Reply on news.ycombinator.com