so todays yubikey vuln now puts the yubikey in the same category as your rfid badge.
people have been cloning those for *YEARS* but everywhere still uses them. requiring physical access is a pretty high bar, and its way easier to clone an rfid badge than it is a yubikey - because youd have to physically steal it and plug it in vs 'just be near it for a moment'.
its not a death sentence for yubikey. just treat it like an rfid card and come up with a revocation process.
Viss
npub12a…xyvvc
2024-09-03 18:22:21 UTC
Author Public Key
npub12aszc2xqlhhlug489ldgzdgd3cap6ndjf2y43lw2dmm5qc7szveq3xyvvcPublished at
2024-09-03 18:22:21 UTCEvent JSON
{
"id": "4782f9c9fd81956f64be87deabfd1d53b35daa6ec9ee467a0b91e067b509f20b",
"pubkey": "57602c28c0fdeffe22a72fda81350d8e3a1d4db24a8958fdca6ef74063d01332",
"created_at": 1725387741,
"kind": 1,
"tags": [
[
"proxy",
"https://mastodon.social/@Viss/113075011005839950",
"web"
],
[
"proxy",
"https://mastodon.social/users/Viss/statuses/113075011005839950",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://mastodon.social/users/Viss/statuses/113075011005839950",
"pink.momostr"
],
[
"-"
]
],
"content": "so todays yubikey vuln now puts the yubikey in the same category as your rfid badge. \n\npeople have been cloning those for *YEARS* but everywhere still uses them. requiring physical access is a pretty high bar, and its way easier to clone an rfid badge than it is a yubikey - because youd have to physically steal it and plug it in vs 'just be near it for a moment'. \n\nits not a death sentence for yubikey. just treat it like an rfid card and come up with a revocation process.",
"sig": "ea38d1caa533eb9bafd89a79f7559473e1f2292d09b2adc2fab446bf4e9703cc67ba370b379589e7021d846cfc508b69cb7cb59a5ac577fe2330b6d8a75b0dde"
}