2FA Isn’t Secure - Here’s What You Need Instead!

[@ShannonMorse]

Pinning this comment so y'all can easily find my previous videos about Yubikeys! kzbin.info/www/bejne/rJu3cml6mqlsr5o I'm seeing the same questions several times and I answered them in this video!

[@TheCynysterMind]

Sadly MOST financial institutions do not support FIDO keys. As of now None of my banks nor credit cards nor retirement or payroll sites support hardware keys. But pointless sites like social media do...

[@SaHaRaSquad]

That's the exact reason I haven't bought a Yubikey yet. My bank account is one of the least protected because banks ironically don't seem to be interested in proper security. The only account I care about which supports yubikeys is the email account, which is important but it's just a single one.

[@paulbigbee]

Glad you made this point. Financial services have successfully externalized all of the costs to other parties, including us, their customer. Even Bank of America's WebAuthN implementation is pathetically lazy. By contrast, gaming companies have had to bear the burden of taking calls, creating tickets and recreating state in the game. In short, cost. So, they went looking for a better answer. TL;DR - incentives are for banks, sadly, to do nothing.

[@TheCynysterMind]

@@SaHaRaSquad I would recommend getting the cheaper fido keys( you should have at least two.. I have 3) and experiment with them on a site you do not care about so you can test the ins and outs

[@Tech-geeky]

That's because they gotta cater for everyone... The larger population of users, the less secure it will have to be.. We always cater for the 'bottom line' the least secure.... The reason why banks usually won't adopt better security is "Our platform doesn't support it", or "it will be too costly". I would say its about bloody time users got educated.... We all wank bank to stop scammers for us as well, but going "so far" with anything, will force users to be better. To me, that is a good thing You can't expect a business to hold ya hand 100%..

[@TheCynysterMind]

@@Tech-geeky I am not sure I agree with your assessment. *That's because they gotta cater for everyone* Doesn't Social Media as well? If social media can manage to implement better security.. The banks should have no difficulty. And let us not forgot. This technology is available for those that want it. The broader clueless user base is not likely to forced to use this tech with obvious security benefits. But financial Institutions seem to be purposely taking steps that make accounts "Appear" secure without ACTUALLY being secure.

[@mrfoodarama]

Great topic! I wish more companies would add this to their sites, particularly US Banks!

[@Darkk6969]

I agree. My current bank only uses SMS which is insecure. Better than nothing I agree but at least offer Google Auth as an option!

[@BioBrimm]

Yes! I was the victim of a SIM swap and haven't wanted to use my phone for anything since but am often forced to. Even though I invested in a hardware key, it's rarely an option on its own.

[@briancarnell]

This is the real problem. So little support for hardware keys still.

[@notreallyme425]

Nah, my bank just asks for my dog’s name. I’m sure that safe.

[@gblargg]

@@notreallyme425 I generate random strings for each one of those. They are essentially passwords so you should make them secure.

[@headlights-go-up]

Such a good video! Your work spreading knowledge on the greatness that is hardware keys (as well as your hard work in general) is very much appreciated.

[@ShannonMorse]

I appreciate that!

[@Blox117]

it should be a part of the device itself, inside TPM

[@anamegoeshere]

@@ShannonMorse so once you fail IT and this platform, when are you making a o/f ?

[@VincentGroenewold]

Thanks Shannon, I bit the bullet and used the promo code. Ordered 2 keys, one as a spare. :)

[@ShannonMorse]

Smart!!

[@supawiz6991]

“Use the for your most critical accounts” Too bad most banks don’t support it. My bank just finally added support for TOTP. If it takes them the same amount of time to add support for hardware keys as it did for TOTP, it’s gonna be quite a long time before it happens. Hardware keys are king. I use them on any site that supports it. I also use them for ssh access to my servers.

[@chrisguli2865]

I wish they did this for online (and offline) credit and debit purchases - fraudulent charges would go to virtually zero. So just having the card number and details would not be enough for a purchase to go through. Some banks have started doing something like this using virtual card numbers.

[@azclaimjumper]

Bank of America, at present is the ONLY U.S. bank I know of that permit their customers to secure their accounts with YubiKeys.

[@Nanabon23]

Been following both this account and Sailorsnubs account for a while. Not only you just completely sold me on getting a personal hardware key but coincidently I am currently writing an essay about authentication vs. authorization for my cybersecurity class. I was just casually watching your up-to-date videos because I really enjoy your content! But when I heard you mentioned authentication / recent events and why Yubikeys are a must for 2FA. I was like wait a minute... Hold up! This is a good example for my essay! Write this down Write down! LOL Thank you for providing us important information! I will make sure to properly cite your video! Much Love

[@writingpanda]

Any time someone talks about Yubikeys, that's an instant like from me. Great video, Snubs!

[@ShannonMorse]

Much appreciated!

[@mschwage]

Agreed. I was hesitant to get one... I didn't understand them, and I was worried I could lose one. So I bought two, eventually, and when I used them I was an instant convert.

[@writingpanda]

@@mschwage I'm so glad you decided to invest in some Yubikeys! You're doing it right!

[@mihai-mcw]

To sum up the video.... 2FA is not secure.... Use 2FA instead....

[@RyoKimball]

Immediately after hearing your comment on art on the key, I grabbed mine and started looking for art supplies.

[@Macleod1617]

Thanks for the code! It works for EACH Yubikey you buy. Its best to buy 2 just in case you lose one and you wont get locked out of your accounts... I got $10 off my purchase. Thanks again Shannon!

[@ShannonMorse]

Yesss this is the way!

[@feargalledwidge806]

Hardware keys are a great idea in principle - but in reality, for large companies can be a nightmare to manage. Users lose their hardware keys or forget and leave them at home - so you security team is constantly issuing new keys or temporary keys. That is why phone auth apps reign supreme. Even the worst user will always remember their phone. Normally when I do 2FA deployments - I do phone apps as the primary option with yubikeys for those users who don't want o use their personal phones.

[@BDBD16]

What about those non smart phone users....yup...encountered it before.....

[@feargalledwidge806]

@@BDBD16 That's why phone apps are the primary option - but not the only option. For people without smartphones or who don't want to use their personal phones - the a yubikey covers those cases.

[@tudalex]

Hi, here is a simple trick. Give them the micro keys that will always stay plugged into their laptops/workstations. If you are trying to protect from stolen laptops, configure the yubikeys to also ask for a password, not just a tap. Another way I’ve seen it done was to suggest them to have them attached to their badge keyring or home keys.

[@klwthe3rd]

I couldn't agree more. I work in IT Security and if you read my posted comment, it talks about people losing or forgetting their keys everywhere but on them.

[@esquilax5563]

Who are these people who are going to work without their keys?? The whole idea of these things is you keep one on the same key ring as your house key, so you're essentially never without it

[@chickpeas.are.versatile]

Great video, Shannon! Although I wish some companies would implement it fully rather than do it half-arsed. For example, some sites only allow 1 hardware key to be registered… By not allowing a backup key to be registered it just increases the risk of me getting locked out of my account if I lose/break my main key. Hopefully more and more sites will fix this issue in the future and it is videos like yours which will help increase awareness and adoption so that these problems are eventually solved ✊

[@longlashcoffeecatcoffeecat7551]

We've seen websites that offer SMS and auth app. And the more rare SMS / key combo. If you're lucky you might get a website that offers one of each method or up to TWO keys. But, my favorite sites are the ones that allow you to use ALL methods and as many as you like. One change I would at least like to see is if you're required to have 2 methods to activate MFA, that you can use 2 keys and/or not have SMS be mandatory. But SMS is about "We know you're a human being"...at least that's what the American banks, etc, tell us. Are cybercrimes at the point where either phone companies or websites should be held responsible for sim swapping if SMS is the only 2FA method available? If the answer is "Yes", then what happens to users that refuse to use 2FA or websites that don't offer any? Like the recent password stuffing attack on PayPal.

[@SgtKilgore406]

This is exactly why I stick with TOTP instead of pushing forward with hardware keys. I can't trust myself to not lose it and royally screw myself over.

[@autohmae]

Yes, this is a big missing part. What they do often allow: a list of 'recovery codes'.

[@AG-bp3ll]

@@SgtKilgore406 I totally agree with this. I can't have everything tied to a single key. These keys are tough but they can get damaged or lost. You either can't have a second key or you have to leave a backup to get in that someone could just use to bypass the key anyway.

[@BogdanSass]

THIS! I don't know if they fixed it, but a while ago even Amazon AWS only allowed you to register one (ONE!) security key!

[@mikaellavoie6811]

Just found your channel, listened to 3-4 video in a row and i suscribed! Very good content and very well vulgarised/explained while maintaining some technical information for more tech savvy people! Good job!

[@ShannonMorse]

Hey welcome to my channel! I'm pretty active with the community here if you ever have questions or just wanna say hi 😄💓

[@gunnargu]

Did not notice this in the video, these security keys work with the browser so that if a phishing site looks similar to the real website it still won't allow authentication, because the domain does not match.

[@ShannonMorse]

That's correct!

[@ericdere]

TOTP keys in a 2FA app are not sent to you, they are generated based on the initial seed code which you get by scanning the QR code. A 2FA app is therefore more secure than 2FA via SMS or email

[@SgtKilgore406]

I'm surprised OP missed that. I don't consider SMS or email as 2FA. All my 2FA are TOTP keys which as you said cannot be intercepted provided you are smart with your secrets. If it wasn't for my aptitude to lose things from time to time I wouldn't be as afraid to invest in physical keys. At this time I see it as too risky to use a security device that small and potentially that easy to lose.

[@joseabraham777]

But what happens if I lost access to my phone? The websites offer an easy way to restore my logins? I have that doubt :/

[@ericdere]

@@joseabraham777 There are two possibilities: - you backup your 2FA data in the app to the cloud - you use recovery keys which you can get from the site you login to (do this before losing your phone)

[@buffalo_wings8224]

@@ericdere Please help me understand how these recovery keys don't completely undermine the concept of 2FA. A brute force attack can penetrate the static recovery keys even when the website tries to circumvent. Most of the recovery keys I have seen are 8 digits long max and the sites don't lock you out after multiple tries. Sometimes the recovery screen defaults back to the username/PW login screen after several failed attempts, but a crafty hacker can automate the brute force attack. At the very least, the recovery codes provided should be much much stronger.

[@Tech-geeky]

still depends on weather people keep their device up-to-date and app(s). Apps depends on operating system and therefore device.. QR codes are not perfect either. and i wouldn't really reply on them for security. TouchID is better. Its all a stepping stone... How secure do you wanna be ??

[@joeltyler3427]

Yeah. Companies should have this mandatory. No matter what job role.

[@Lucy-dk5cz]

Absolutes are never the solution. The security required needs to be tailored to each specific case.

[@Plexdet]

Example: someone who’s job is welding or some other construction work and they never need to log into a computer at work.

[@klwthe3rd]

@@Lucy-dk5cz I agree. Well stated.

[@himabimdimwim]

I bought two yubikeys after watching your previous videos on hardware keys, I'm excited for them to arrive!

[@ivanbarksdale]

Very insightful video! Btw I ❤your sailor moon shirt it compliments you and your setup beautifully ✨🤟🏾

[@PPNStudio]

ProTip: Don't keep your key / security dongle in the same place as your devices. (If a thief steals your purse or laptop bag and the key is inside it, they now have access to your accounts.)

[@Ghoul847]

set up a pin, disable key 1 asap in account with backup key. A thief would need to know your usernames and passwords unless you have it setup where you can login just using a key then you’re screwed 😬. You really do need a second key in case of doubts

[@krstnhkn]

This video came at a perfect time. I've been wanting to get a Yubikey for years but never got round to doing so. Now finally ordered one, thanks for the $5 off! :D

[@azclaimjumper]

Do yourself a favor & follow YubiCo's STRONG RECOMMENDATION, go back & buy a 2nd Yubikey, incase you lose your first one.

[@zapman2100]

and yet none of these company's will ever allow these to be used with any product because they don't really care about your data and its security.

[@vasiovasio]

Great overview! Thank you, Shannon!

[@Taikaru]

Fantastic shirt! As someone who stumbled onto the video randomly, that was quite unexpected. :D

[@AndyBlackman]

I picked a key up a long time ago. Didn't use it very much. Now I am changing my opinion. Now I just have to figure out how to activate it again.

[@Felix-ve9hs]

I somehow ended up with 8 (eight) Ubikeys, don't ask me how 😅

[@uptbug]

As I sit here in my living room, nodding my head in agreement to the statement 'hardware keys are a must', I look down and notice that I am currently wearing my green and blue yubikey socks.

[@beauregardslim1914]

I prefer to use someone else's finger. That way I can keep it in a locked box in a secure location. 😆

[@ShannonMorse]

lmao wat

[@Tech-geeky]

😆 did i read that correct?

[@beauregardslim1914]

@@Tech-geeky Of course I'm kidding. I'd have to keep them in a freezer and wait for them to thaw every time I wanted to login to GMail. Who has time for that?

[@MissJaye11]

First thing I noticed was the Sailor Moon Tee!! Love it!

[@AnthonyGoodley]

The fact that Twitter is forcing users to to either pay for Twitter Blue or else you must remove 2FA is unbelievable.

[@dj_chateau]

This is not true. Twitter is only forcing you to pay to use SMS 2FA, not other forms of 2FA. TOTP and hardware keys are still possible for free.

[@AnthonyGoodley]

@@dj_chateau Thanks for correcting me. I will research this further.

[@dj_chateau]

@@AnthonyGoodley You're welcome! Don't feel too bad about this one. When Twitter announced it and put up the alerts about it, it was so badly communicated to end-users that many of them would have reached the same conclusion you did when it was spelled out right to them. This led to a large amount of prominent Twitter users misunderstanding and reporting what you just did, which snowballs and propagates that misinformation. I think the other reason it was so believable was the logic that people wondered why Twitter thought people would want to pay for a less secure 2FA option. Which is a fair question. Why would they do that? It came down to cost-cutting to lower their bill with Twilio whenever any user would use SMS 2FA and most users not understanding the distinction.

[@JohnnyMcMenamin]

I've been nothing short of secure (and pleased) using my Google Titan key.

[@networknightmares7744]

So hardware keys aren't 2FA? Confused... I thought they were a 'second factor'

[@KevinTurner-aka-keturn]

I'm trying to think through the scenario you described as the reddit compromise, which sounds to me like a mal-in-the-middle situation where the attacker convinced the mark to type in their TOTP code to the phishing site and then relayed it through to the target site in near-real-time. I watched the "debunking 5 myths", but this part still isn't clear to me yet: how does a key defeat that attack? does the protocol restrict the key from sending its response to a server other than the one designated for that account? How does that work?

[@steamfox]

I was a bit surprised this wasn't mentioned in the video since it seems to be what truly differentiates a FIDO2 key from for example an auth app or a "legacy" HW key. In my understanding FIDO2 protocol does protect from this type of attack, making it an "unphishable" authentication method.

[@gblargg]

@@steamfox How can they defend against this? The middleman essentially relays everything until validated.

[@jamesphillips2285]

@@gblargg The middle-man uses a look-alike domain. So if the domain name is used in the challenge: the response won't be correct for the real website.

[@gblargg]

@@jamesphillips2285 How does the USB device know where the challenge is coming from? Just forward the authentic challenge from the authentic site.

[@jamesphillips2285]

@@gblargg Without getting into the standards documents (Apparently U2F was renamed CTAP is how far I got), the browser must pass on the web domain as part of the challenge.

[@coisasnatv]

Hardware keys are useless, try to lose one and tell that to AWS or any other services that use on of those to see what happens, it is a stress you don't want in your life. In my case, I lost all my keys in a flood that destroyed my home, do not trust security hardware, use a password manager instead.

[@therealb888]

I need this, couldn't have uploaded at a better time.

[@juliusrowe9374]

Great content Shannon! Super informative too!

[@AT-os6nb]

For all those who haven't seen or subscribe to the alliance for Responsible citizens check it out. A great start to ARC..... Thankyou Jordan Peterson and all the others involved in bringing this alliance to the world. This (ARC) is what we desperately need. Genuine facts and leadership. Now it is up to us, the public, to do our part. Spread the word, help grow the "Alliance for Responsible Citizenship", and do YOUR part to help bring about a better more positive world for all of humanity. Put an end to the distopian vision offered by the elites of Davos and the WEF gang. Bring individual Freedom and responsibility back to the forefront of a free and prosperous society. Thankyou.

[@ZhouDynasty314]

wish I saw your code before I bought them, but I will send it to my friend so you get credit for helping us secure our accounts!

[@rob-toolsandtech2521]

Awesome video, Snubs. I've been thinking about this more lately with what recently has come out with companies such as Tmobile and Bank of America.

[@tanked1313]

Oh thank God I thought I was compromised! I've had a yubikey for years!

[@bourne_]

Got 2nd physical key like a week ago (Kensington USB-C with biometric layer) and I love it. I was finally able to add key to Windows/Outlook account!

[@michaelupchurch3779]

Great video thanks 😊 Shannon hope your well

[@khayla_matthews]

Really useful info. & I love your t-shirt! It's so cute

[@ShannonMorse]

Thanks so much!

[@lennyvlaminov9480]

I remember when Cubase went with a hardware key in order to use the software. It was via the serial port, brilliant right? Internet was flooded with codes/code generator sfor all softwares - Cubase included. At the end of the day there is a input of a/many string/int. I'm only a software, okay let's emulate that device. With that said, hardware keys are crucial for top security.

[@wavemakersdj]

I would add as a massive one to these other attacks, what happened to the LastPass dev that they just revealed. Their devops engineers were using two factor of the Microsoft app request instead of requiring a security key. A keylogger installed via what seems to be a rogue Plex server download or Plex server insecurity copied the password on a the dev's personal computer and they pushed an MS app auth request to the engineer, who accepted it. Last pass says in response to that breach: "We enabled Microsoft’s conditional access PIN-matching multifactor authentication using an upgrade to the Microsoft Authenticator application which became generally available during the incident." What?! So now they'll look at running malware on the phones to get the pins. WHY NOT USE THE KEYS?!?! Yubikey auth would have stopped this one!

[@ShannonMorse]

I just read about that last night!

[@wavemakersdj]

@SME Pictures sure, but the difference is on the other side. Pressing accept on a prompt or having numbers flash on your phone is able to be seen/pushed/stolen by others without you doing anything if they have the right malware. Not the same for you taking a security key, inserting it into the device, and pressing the button. You can't screen capture or keylog that physical action.

[@lowbar77]

Lastpass' day is over. I have moved on.

[@xybersurfer]

recently the Microsoft Authenticator app has started asking for a 2 digit PIN instead of just asking to accept, in most cases. the PIN is shown on the website you are logging into. when the request arrives at the app, then the app asks for the PIN to be able accept the request. i think that might be what they mean. this way you can't unintentionally accept a request that someone else made, because you don't even know the PIN that you are suppsed to enter to accept it. the attacker can't even spam you with requests because, and make you eventually accept to make it stop because you don't even know the PIN

[@JediOfTheRepublic]

LMAO, yeah that is on the Engineer who accepted the push not a flaw in MFA.

[@brianray8484]

Can you explain the difference between something like Yubikey and EveryKey?

[@TheHeff76]

Shannon, I love my YubiKeys. What is that full callsign on the shelf? I'm a HAM Extra! And Ethical Hacker. Oh the fun we have on the air. LOL.

[@estusflask982]

Physical security keys are the future. Just like your car and house keys, you'll have a Yubikey to login to your accounts. Yubikeys could even be used with smart locks to replace your car and house keys.

[@JediOfTheRepublic]

lmao, Car and House Keys are becoming obsolete with smart locks. You don't need a key to open your car anymore, you use a keyless fob. You also don't need a key to start you car anymore. Your comparison doesn't make sense.

[@PE4Doers]

Great video Shannon 🙂 As a reminder, I'm the guy you met at your presentation at the 2021 VidSummit in LA, that had the broken CISSP membership card. I have completely converted to YubiKey and not a second too early. I hope things are going well at your end 😉

[@nathanielh8239]

I have a question/scenario what about when we have automatic login for discord or slack is there an application that can you sign you out automatically so it’s not saved when you login/boot again?

[@alterechtjetzt4647]

Are you aware that you're door keys can be copied if someone gets to take a picture of them?

[@ShannonMorse]

* Your *. Are you aware I did a video about that 3 years ago? If not, go watch it! kzbin.info/www/bejne/f5qydWiEaaprpqc

[@circuitmasters5258]

Hardware keys can be emulated but it depends on what kind you use 😎 yubikey is awesome 👏 or nitro keys

[@josepablolunasanchez1283]

Even if you have these keys, if you allow your machine be infected with malware, bad actors can steak the session cookie and use it as if you had logged in in their computer. So even these keys are not safe. It adds an extra layer of difficulty.

[@JonatasAdoM]

Time to not use 2FA and instead a specific login and password that you do not use anywhere else but a secure device. If sites allowed you to login without typing credentials, the only risk would be data leaks.

[@ThorstenMerz]

I love the colours on what appears to be the "Shannon Morse Edition" of the Yubikey, but it doesn't look like something Yubikey offer in their online store. What a shame. :(

[@acerhad]

Thank you for your knowledge, I've been on the fence about getting a yubikey and your video did it for me. I got a mini already and I am thinking about getting a 2nd one as a spare and for my mobile devices. i am having some problems getting It to work but i am sure ill figure it out eventually.

[@muralisan-zt4hj]

but this doesnt solve the problem of a hacker who has already gained access to your computer, they can just sit back and watch everything your doing and still gain valuable info.

[@ShannonMorse]

If a hacker has already gained access to your computer, then you have much more serious problems with your network. But that's like saying you shouldn't lock your door in the future because one time you got robbed. 🫠 Why the heck would you not wanna first fix your network issues, and then harden your online security with 2fa?

[@azclaimjumper]

@@ShannonMorse right on

[@justicebrewing9449]

its essentially a key fob. used in enterprise application since.. well I had them in 2001, so before that :)

[@myname-mz3lo]

get ready for muggings to be more common

[@michah321]

I'm really afraid to buy one if these because they're all on Amazon and heaven knows where they come from

[@murph1329]

Developers need to be able to tap into the TPM module for security checks. It would accomplish the same thing without the need of a lanyard of hard tokens.

[@michaelbyrne5316]

I used for Gmail account and Facebook account and Twitter account for protection

[@gothparadigm]

thank you so much. i definitely intend on getting one soon. 🔑

[@LCFTW93]

I misunderstood the title/thumbnail and thought it was saying hardware tokens were not safe...

[@andratek]

With the "pass the cookie" the hacker can steal the cookie session to hack the account.

[@ShannonMorse]

I did a whole episode on cookies on my channel, you should check it out!

[@ZiggyDaZigster]

What about stealing the key the validates your fingerprint. Not the finger. The auth that validates it.

[@Dobbo314]

I've been think of getting a Yubikey to protected by BitWarden vault, but the question I have is how do I set things up so if I lose the Yubikey how do I get access to the vault?

[@ShannonMorse]

Hi! I answered this in my previous videos, 5 Myths About Yubikeys. kzbin.info/www/bejne/rJu3cml6mqlsr5o

[@Dobbo314]

@@ShannonMorse Thanks. I must have missed that video - will go watch now :)

[@Macleod1617]

Its best to buy 2... 1 is your primary & 1 is backup in case you lose the other. Keep 1 in your safe or somewhere secure.

[@Dobbo314]

@@Macleod1617 @ShannonMorse Thanks for the help. Just placed an order for two Yubikeys.

[@azclaimjumper]

Excellent & timely content is THE REASON I subscribed & why I always ring the notification bell after watching one of your videos + I always leave a comment. My computers REQUIRE a YubiKey to log in, my Yahoo, my Google, My Bitwarden Password manager, My GoDaddy, My encrypted email account with Tutanota, ALL REQUIRE my YubiKey to log in. YES, I have 2 Yubikeys in case I lose my primary key. I don't have & never have had a so-called "Smart" phone or any so-called "Social Media" accounts. Warm Regards from Reno, Nevada

[@adesantoasman8585]

Ahhrr.. Sailor Moon, what a time it was 😊❤

[@JohanlastZa]

Do anyone know what their stance on security requests are from US law enforcement/government? We all know that US based/developed security software/hardware must be able to be accessed by government/law enforcement WHEN required. This is why I do not use any US based cloud service for important stuff, because what is the point when they can get access by just providing a piece of paper ordering a company to hand over access?

[@paul-erikhansen5769]

Just need more companies to support it….. many ie. mail and or cloud providers dont even know it exists…. 🙁

[@LedoCool1]

Never has been.

[@hugoedelarosa]

The thing I cannot stand about Yubico keys is that they are expensive but are not made out of durable materials. I carry one in my keychain, and it is all scratched up/beat up. It is becoming less reliable as it is not detected right away by my computer when I plug it in (it takes a few attempts)

[@dixztube]

I love mine but still be paranoid

[@musiceditor7083]

Great video Shannon - on the subject of accidentally losing this key... what do you do then? Can you buy them in pairs so you always have a spare?

[@ShannonMorse]

Hey, I did a video about this! kzbin.info/www/bejne/ZprUYXWdnrCfja8si=bH7HqS8xGnVOAZZc

[@paulojacob]

Very informative video! Thank you!

[@raymondfinkle4257]

Yubikeys are still vulnerable to this kind of attack.

[@JohnDoe-el5ir]

Sadly said none of these keys is resistant to man in the middle attack, literally none. If hackers fake the system we want to access to, like web site , program etc. , then they can steal credentials and access at the same time that system. There were for some time physical tokens, small devices with lcd and numeric keypad. You had to enter pin, then bank sent few digits challenge to be typed in , token returned response code to be typed back on bank's web site. It was a cool idea. But again, this is not resistant to man in the middle attack neither. Actually nothing is anyway. Then banks went entirely to sms codes and smartphones aps.

[@RobSnow-ui4sz]

Great video- So how do you prevent Google from using sms from being used? You can do it with a work account but not in public account. Would you have to use Google advance protection program on your personal account in order to prevent sms. Then you can't use an authenticator app.

[@OH10mm]

So I have a question. How do I incorporate Yubikey with FIDO 2 protocol so that if something were to happen to me, my spouse could still gain access to accounts?

[@Barbara-lu7ch]

So when the key fails, as hardware does, are you locked out?

[@speedibusrex]

You need a dedicated hardware token which is not connected to the Internet + brute-force protection.

[@StirsMYCookiez]

But reddit doesn't support Hardware Keys.. so the employees could only do what the website provides.. TOTP.

[@AnonymousFreakYT]

I'm just annoyed that PayPal only allows a single hardware key. So I can't have a backup like everyone should do. (I have a USB-C+NFC key and a USB-C+Lightning key since I'm an Apple droid.)

[@cybermousey]

Great video. Great shirt!

[@mumbles1justin]

I curious if theres a disadvantage or concern that should be considered when using the “Onlykey” over say the yubikey?

[@zardoz2627]

I've never seen a static 2FA passcode. All mine are random generated and sent to me by text.

[@MrGhost9640]

Curious if I bought a USB a security key and wanted to use a USB a female to USB c plain jain adapter would this work or is it specific to the company

[@CaroAbebe]

What happens if a key stops working? 🤔 Just about anything wears out, after all.

[@ShannonMorse]

Websites generate Backup Codes when you enable MFA. These are only generated once so you have to copy them or print them out before leaving the setup. I've done previous video tutorials showing how to setup a yubikey which explain this process in depth. (I'd also recommend setting up a second yubikey and storing it somewhere safe in case your main one gets lost or destroyed).

[@WB6SVS]

Is that an amateur radio callsign behind you on your right? (KM???)

[@courageousone3510]

Hi great video!! Question how do you log into a website that doesn't use a key but wants you to use 2FA instead?

[@Alex7zest]

So what happens if you accidentally damage you hardware keys ?

[@ShannonMorse]

Backup keys and backups codes. If you want more info, I'm uploading videos about BOTH of these options in the coming weeks. Stay tuned!

[@OliverDieste]

Not a tech guy, but...with some kind of attack in the style of man-in-the-middle, if you log to a fishing page, they will get copy of the authentication you sent with your hardware ID, so...what is there the advantage in front of a digital certificate?

[@ShannonMorse]

Here, watch this video my friend Rachel did. She demoed how phishing would be blocked if the target uses a hardware key. kzbin.info/www/bejne/i6izfJKfmtmorsk&feature=share9

[@nonshatter7]

When it comes to Crypto hardware wallets most recommend going directly to the maker to purchase rather than a third party like Amazon (due to the threat of tampering etc). Would you suggest the same thing for Yubikeys?

[@jbinfa7k]

Add don't expose yourself to the internet that you are Steve Jobs' personal IT guy.

[@allanjones9068]

Will I be protected from session highjacking if I'm using a Yubikey as 2AF? It didn't get very clear if someone gets my cookies they'll be able do login even with the key. Thank you

[@stalbaum]

Can I get a chip in my hand? I would keep this on my key ring. Though rare, I have lost my keys.

[@techadsr]

Overall, great video. Industry needs more adoption of these hardware keys. Just one nit though. The pattern unlock is not really behavioral authentication.. yeah, maybe if they implement it with more than just detecting which numbers were touched. Behavioral auth to me is more the like the key cadence measurement and mouse movement with detected reaction to small movement interference. They could do that with the number swipe pattern but how many implementations do that?

[@JediOfTheRepublic]

No we don't. The industry just need to use proper MFA practices.

[@ccrabbit8768]

Only problem with this (I Like to use authenticator app for a similar reason) is that most websites will offer more than one choice for 2 factor authentication code, ie 2 Factor Authentication required do you want to use 1) authentication app, 2) email 3) or text message. Which means if my email or phone is hacked they still get in even if I have my real phone with me.

[@VarunVsWorld]

Nice T-shirt 😍