Hacker News Reader

Comment by mabbo | Hacker News Reader

Do MailChimp employees not need a Yubikey or some other secure OTP generator to access customer data?

Or does the attack involve the user sending their OTP as well?

Either this is a pretty heavy handed attack, or MailChimp aren't following best practices in terms of security.

For a corporate setting where you can replace keys easily, I would choose Fido keys and SSO protecting all access into the network instead of OTP/VPN as that is generally immune to social engineering attacks / leaked passwords. Additionally, it’s trivial to manage those keys in a corporate setting centrally.

For personal use, I still prefer OTP because I’m not fully comfortable that I won’t lose some key and forget to revoke it everywhere and/or lose permanent access. Phones are getting very good at being that security key with backup but I’m a little hesitant to do that because I’m not sure of the interop story.

while most implementations don’t require 2 security keys, most services highly suggest that you enroll 2 keys, and that you keep one in a safe place for backup.

e.g. Apple’s new icloud Security Keys support requires 2 keys to enroll

The likelihood of me keeping track of both well isn’t great. And then of I lose one, how do I go about revoking that from all the services? Not to mention that enrolling 2 keys requires you to have both keys every time you enroll. So I’m not sure how practical that is and how you know when you’ll need both keys. Recovery codes seem like a better option but then you’re stuck figuring out how to keep them around securely… OTP + diligence against social engineering is so far the only thing I’ve found that I trust. It’s not the best but multiple Yubikey’s sounds wrong and impractical as well.

You just ask the target to install teamviewer or anydesk…

These are probably support staffers working from personal computers at home using some sort of remote desktop software, hard to enforce any security policies.

This is one of the places where ChromeOS is an interesting option. If the employee literally can't install software, it's very hard to get owned by malware.

Reply on news.ycombinator.com