FIDO

Secure

when

Security

You can also read this news on COINTURK NEWS: <a href="https://en.coin-turk.com/users-secure-crypto-assets-with-yubikey-despite-vulnerability/" data-wpel-link="internal">Users Secure Crypto Assets with YubiKey Despite Vulnerability</a> 
One way to keep your <a href="https://en.coin-turk.com/cryptocurrencies-focus-on-real-world-assets/" data-wpel-link="internal">crypto</a> assets secure is by using YubiKey, but there’s a problem. A vulnerability has been discovered that users who purchased a lifetime YubiKey must learn to live with. Let’s first discuss why YubiKey is important for crypto asset security and then talk about its lifelong vulnerability. 
<h2 style="text-align: justify" id="what-is-yubikey">What is YubiKey?</h2> 
FIDO Alliance developed this USB-sized device to assist with identity and password verifications. This authentication device, supporting 2-factor and FIDO2 authentication protocols, keeps your crypto wallets secure. You can think of it as a version designed to protect the passwords of cold wallets commonly used for cryptocurrencies. 
It can work offline, allowing you to log in by simply touching the key instead of entering a password, without relying on a phone. This way, you don’t need to store your exchange passwords or other private keys on WhatsApp, email, or paper. 
<img loading="lazy" loading="lazy" decoding="async" class=" wp-image-385841 aligncenter" src="https://coin-turk.com/wp-content/uploads/2024/09/yubikey-nedir-ne-ise-yarar.png" alt="" width="641" height="295"> 
You can also use it by tapping it on your phone thanks to the NFC feature. You can even set this YubiKey as your key when you want to log into your computer. This way, physical access to your computer is not possible while the device is in your possession. This device, compatible with applications like Lastpass and <a href="https://newslinker.co/category/technology/" target="_blank" rel="noopener" data-wpel-link="exclude">Google</a> Password Manager, can be used not only for your crypto accounts and wallets but for all your accounts. 
For extra security, some users buy 2 YubiKeys, using one actively and keeping the other as a backup or recovery key. 
<h2 style="text-align: justify" id="yubikey-security-vulnerability">YubiKey Security Vulnerability</h2> 
Everything is perfect unless someone holds a gun to your head and takes your YubiKey. However, a significant security vulnerability that you need to get used to living with was recently discovered. Cybersecurity experts found a vulnerability in YubiKey two-factor authentication keys that allows the device to be cloned. This vulnerability was discovered in the Infineon crypto library used by almost all products, including the following series: 
<ul style="text-align: justify"> 
 <li>YubiKey 5</li> 
 <li>Yubikey Bio</li> 
 <li>Security Key</li> 
 <li>YubiHSM 2</li> 
</ul> 
Yubico stated that this security vulnerability is of moderate severity and difficult to exploit. Experts mentioned the following details in their comments on what to watch out for: 
<blockquote> 
 “An attacker would need to have physical possession of the YubiKey, Security Key, or YubiHSM, have knowledge about the accounts they want to target, and require special equipment to carry out the attack. Depending on the use case, the attacker might also need additional information such as username, PIN, account password, or authentication key.” 
</blockquote> 
Although it seems difficult, attackers who believe they can access a significant amount of assets might overcome this challenge. In state-sponsored attacks, the success rate is higher because access to much information is easier. Additionally, knowing how extensively teams like Lazarus work and infiltrate companies, <a href="https://finance.coin-turk.com/" data-wpel-link="exclude">investors</a> holding large amounts of assets need to be much more cautious. 
Since YubiKey firmware cannot be updated, all YubiKey 5 devices before version 5.7 (or version 5.7.2 for the Bio series and version 2.4.0 for YubiHSM 2) will live with this vulnerability for a lifetime. However, later models are not affected by this vulnerability as they do not use the Infineon crypto library. 
The post <a href="https://en.coin-turk.com/users-secure-crypto-assets-with-yubikey-despite-vulnerability/" data-wpel-link="internal">Users Secure Crypto Assets with YubiKey Despite Vulnerability</a> appeared first on <a href="https://en.coin-turk.com" data-wpel-link="internal">COINTURK NEWS</a>.

Users Secure Crypto Assets with YubiKey Despite Vulnerability

Table of Contents

COINTURK NEWS

Other articles published on Sep 5, 2024

Top Cryptocurrencies to Invest in Now September 5 – Shiba Inu, Injective, Jupiter

United Texas Bank Faces Federal Action for AML Failures in Crypto Dealings

Bitcoin in October: The Bullish Month Ahead – Analysis and Insights

Bybit Lists POL for Futures Trading with High Leverage

C3.ai shares plummet 20% after subscription revenue misses estimates

Russia to Test Cryptocurrency for Cross-Border Payments Amid Western Sanctions

Join our free newsletter for daily crypto updates!