YubiKeys kwetsbaar voor aanval waardoor private keys zijn te stelen (2024)

FAQs

How do I extract my private key from YubiKey? ›

The owner is responsible for keeping the private key secret. Owners can secure private keys with the YubiKey by importing them or, better yet, generating the private key directly on the YubiKey. Private keys cannot be exported or extracted from the YubiKey.

During registration, Yubikey creates a new privatekey but doesn't store it locally, it instead encrypts the privatekey* and uploads with registration success message in the ~64 Byte* keyhandle. The public key is included as well without encryption. During authentication, the server will return the keyhandle.

If you lose your Yubikey, you can still use your phone authenticator app, but you cannot create a backup Yubikey. However, Yubikey also provides methods to recover your account, so you can get a replacement. An advantage to Yubikey is that it comes on a USB that cannot be identified.

Sign in to your account and find the two-factor (or two-step) authentication settings in the security settings. Select the option to use an authenticator program or Google authenticator and the server will generate a secret key and a QR code.

Security Hints

If you trust your environment (like at home) you can keep the YubiKey near or even plugged into your computer. In low trust environments (coffee shops, hotel rooms, etc.) keep your YubiKey with you at all times (in a pocket or purse), especially if step away from your computer, even briefly.

The YubiKey Advantage

Hardware keys are so great because they come on unidentifiable USB sticks. What that means is, should anyone find a lost YubiKey that doesn't belong to them, they can't figure out what device it corresponds to.

So if one is lost or broken then I still have another to log into sites. As for theft, if you're using your yubikey as a 2nd factor then they still can't log in because they don't know your password. If you're using your yubikey as both factors then it either has a PIN or biometrics, so the thief can't log in.

A Yubikey will essentially last forever, and if you stay clear of the insanity that is Passkeys its Webauthn element can support an infinite number of websites.

What are the risks of YubiKey? ›

The theft scenario is indeed disturbing because if the thief learns your PIN and then steals the Yubikey, you're facing severe problems: the thief can easily check all your passkeys, get access to your accounts, remove all the passkeys and register only the stolen Yubikey, change the password, remove any other 2FA ...

Proven security at scale

YubiKeys are trusted by the world's largest companies and users have experienced 0 account takeovers.

The YubiKey works with Password Safe to protect your passwords using two-factor authentication (2FA). Both a master password and a YubiKey are needed to enable access to your Password Safe file, which contains the usernames, websites, passwords and other information for all of your online accounts.

However, as the YubiKey does need to be plugged into a mobile device to function, it adds more friction to the user flow - but this can be a positive when using a feature which requires a longer session, such as a PIV smart card. Pros: Supported on all mobile platforms. Ideal for longer authentication sessions.

Security researchers have discovered a cryptographic flaw that leaves the YubiKey 5 vulnerable to attack.

Highlight the PGP key you want to export, then select the File menu and click Export > Key. Alternatively, right-click on the key to export and click "Export" in the drop-down menu. When the Export Key to File window appears, select a location to export the key, then click Save.

Public key vs Private key

Public key is embedded in the SSL certificate and Private key is stored on the server and kept secret. When a site visitor fills out a form with personal information and submits it to the server, the information gets encrypted with the public key to protect if from eavesdropping.