2020.02.28 Yubikey vs. OTP Authenticator Apps - GlenKPeterson/One-off_Examples GitHub Wiki

This is basically notes from a chat today on the HackGreenville Slack channel, based on a question from a friend:

Is Yubikey more or less secure than an authenticator app like Google Authenticator or the open-source FreeOTP?  It's arguably more convenient, but is it more secure?

We're considering the differences between One-Time Pin (OTP) phone apps such as the Google Authenticator App vs. hardware tokens such as the Yubikey 5 NFC. Both are arguably forms of 2-factor authentication (used in addition to a password).

Pro Authenticator

  • Open Source: FreeOTP (source code) is entirely Open Source so can be end-to-end audited more easily by more people.
    • Eric Anderson points out that Yubikey has an article were they try to defend their reason for not being completely open source.
      • Glen's summary of this article: Yubico started out with a goal of being 100% open source.  But existing hardware was impossible to secure adequately, so they invented their own.  This required an investment that will take years or decades to pay off.  Securing the hardware eliminated any possible way to debug the hardware or to reasonably load software onto it, so all development must be done in an emulator (a virtual machine pretending to be the actual hardware, but with debugging hooks). Using the emulator requires an NDA, so is not practical for hobbyists to develop on. Why does using the emulator require an NDA? Glen suspects that the company owners would have to declare bankruptcy if their competitors got the plans to their hardware, hence the NDA.  Or maybe the emulator is a physical device with debugging hooks physically soldered onto it and hence incredibly expensive? IDK.
    • Barry "Brightball" Jones says there are also open source keys, but admits he has 2 Yubikeys and 1 Nitrokey which is so far just for testing.  Mostly because it can't be used so many places.:
  • It can be updated "in the field" (via software update).  If a weakness is found in the Yubikey, you basically have to wait for a fix to be developed, then hardware manufactured and shipped, then you have to buy a new one.  I guess some Yubikeys can be updated with signed firmware, but that may not be able to work around any bug baked into the silicon.
  • If someone steals your phone, it may still be locked and can be remotely wiped (this thanks to Andrew "Webdood" Orr).  Counterpoint: the key/app is used with a password, so you need both.  A stolen key (or authenticator) alone doesn't do anything.

Pro Yubikey

  • Since the numbers are never visible, they cannot be read by a hidden camera.
  • Doug "nullvariable" Cone (heavily paraphrased): You might get away with using a hardware key on an untrusted operating system because the keycode it generates is only valid once, and it's triggered in response to a specific login attempt. Malware can trigger your authenticator app to run at will (in response to an attacker trying to log in). Glen wonders why a script couldn't detect when you try to log in, then have an attacker log in faster and swipe your code before you can supply it? Maybe because they assume you put your key into your more-trusted laptop/desktop instead of your phone? Paul Wagenseil at Tom's Guide (posted by Doug from HackGreenville) says that, "Apps like Google Authenticator are only as safe as the devices they run on". Alex Dresko notes that malware targeting authenticator apps was discovered in the wild this week.
  • Eric: a human must be physically present and tricked into pressing the key (which is one hurdle) but (Glen sez) they also may immediately realize they have been tricked (detection is not prevention, but it's something).
  • Eric: the key is, "a true second factor because you must possess it."
  • Barry: "There are phishing sites setup to essentially live type your auth key into the prompt of the real website. Not as common, but the Yubikey / U2F being tied to the actual domain prevents this type of attack." Eric said something similar.
  • This is not fair, but the industry seems to be rallying around the key, so more things may work with a key than with the authenticator.

Convenience

Barry: "The biggest win on the physical keys though is actually the user experience. It's dramatically better than the authenticator apps. You login, get a prompt, tap the key. Done. With the app it's Login, get the prompt, open your phone, find the right app, scroll until you find the right key, wait a few seconds in case the time is about to expire, type it in." This comment is currently racking up "plus" votes in Slack.

Adam Hodges: "with google authenticator, there is no easy way to migrate to another phone, if you get a new phone or yours dies or whatever." This started a whole side discussion.

Glen says: Being easier to use means more people can/will use it, so the world becomes more secure.

Conclusion

Eric says, "In the end both are far better than not using MFA but I would put the security advantage to a Yubikey."

Glen says: There are both security and convenience reasons, plus likely industry adoption reasons.