5
Are NFC hardware tokens (Yubikey, NitroKey) less secure than USB-only ones? If so, how to mitigate? (thebrainbin.org)
submitted 3 months ago by to c/cybersecurity@sh.itjust.works
7 comments fedilink hide all child comments
 

Yubikey and NitroKey offer NFC and non-NFC versions of their flagship hardware security tokens (HSTs).

NFC is convenient, but can under some circumstances send e.g. challenge-response exchanges in clear text.

Smartcards using RFID, a similar though not identical protocol, can be queried from ~100cm away.

  • Are there other ways are NFC HSTs are known to be more risky than their non-NFC counterparts?
  • Should users store NFC HSTs in RFID-blocking pouches, like those used for wireless car keys or contactless bank cards?
you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 3 months ago

not an expert on this but i would imagine a Faraday case for it, perhaps with a little flap for ease of access would work?

I would also hope a security company making hardware keys would be aware of and avoid the sending in clear text, as it would be a major vulnerability. Then again, ive never trusted a company to do anything beyond what is absolutely necessary to stay afloat.

  • permalink
  • fedilink
  • source
    •