Increasing personal security online and Yubikey
I have recently noticed an uptick in phishing emails and SMSs, getting me to click on some malicious link and this has been troubling me.
I am fairly good about what I click and so far I haven't clicked anything malicious (I think). However, this has motivated me to up my online security.
All my computers run Linux and I use an Android phone.
For browsing I use Firefox, with NoScript (and uBlock) and use containers for separating personal/shopping sites, etc.
I also have host file blocking on my computers and phone (using AdAway).
I do have a pi-hole setup at home as well.
I also have 2FA setup on all my banking accounts, email accounts etc.
However all my banking account 2FA is still just using SMS. Which I think is now easily circumvented.
Email accounts do use Authenticator apps (like Authy and Google Authenticator).
I also use a password manager (this one), which works well for me, but is only available on my computer and not from my phone. I am split between having my password manager available on my phone tho, since it is always on me and could be stolen or have something malicious installed on. What do you guys think? I am wary of services like LastPass, is that valid?
So I wanted to start a thread to discuss what do you guys do to stay safe online?
I am also considering getting a pair of Yubikey (one backup), are there any caveats/pitfalls I need to be aware of with Yubikey?
For a password manager I have been using bitwarden it has good phone and web integration and it's open source. You can host it yourself if you're comfortable doing that which is nice.
Another "easy" security win is encrypting your /home folder, which is especially important for a laptop but may be desirable for a desktop as well.
I want to second the recommendation for Bitwarden. It's far better cross-platform than its competitors, makes 2FA easy (it can automatically copy your 2FA codes to your clipboard when you log in with it), and huge bonus: You can easily secure the whole password vault with a Yubikey!
Something to note, is that the thing yubikey adds over TOTP (google authenticator) is mostly protection from phishing.
Most sites that support yubikey, also support the FIDO2/WebAuthn standards. So you'd get most of the benefits with anything that supports that.
Personally I'm using Krypton for using my mobile as the second factor. Though they got acquired and AFAIK Android now supports something similar, so there are other options if you wish to go that route.
So I have two Yubikeys - one is Yubikey 4, and the other is Yubikey 4C.
Personally I see little downsides outside of the usual "I'm downstairs trying to access GitHub/GitLab and then the website asks me for my Yubikey, so I rush upstairs to get it, come downstairs, and enter it and go ahead". There's even the little issue of some websites/browsers timeout so you have to do all of this again.
That's pretty minor compared to the Yubikey security. It's dead simple to set up and use - when a website asks for two factor auth, you plug in the Yubikey and then hit the button. Then going forward you will need to plug in the Yubikey and press the button and you're good to go.
Services that I use that require my Yubikey:
Services I wished used Yubikey:
So far it's mainly used to stop people accessing code/services/infrastructure potentially worth ££££ to customers. I wish it was used all over because of the convenience (signing up and using).
Twitter supports U2F, but you have to set up OTP beforehand. It's a bit finnicky and you can always bypass it with your OTP code and it only works in the browser version. For apps you still have to use OTP codes. I guess it's mor convinience than securiety with their method.
Hmm, I checked and it turns out that I did set it up, but for some reason it doesn't work in my current browser, which is Firefox.
It's incredibly puzzling.
Do you have any important online accounts that can use a Yubikey? Google and GitHub can use it, but there aren't all that many others.
Two Yubikeys would work, but one Yubikey and printed backup codes kept somewhere safe might also do.
Also consider which USB interface you need. A lot of newer laptops only take USB-C, so if you get a Yubikey with the older USB you'd want an adapter.
Of all the accounts I have the following seem to support Yubikey currently:
Wish more services supported it (and actually supported 2FA, mainly online stores)
That is a good idea!
Okay. Another gotcha to be aware of is that some of these providers have unintuitive UI's for setting up 2FA and they work differently. Pay attention or you may lock yourself out.
For example, registering another method on Google is additive - you don't lose the old one. Adding a new method to Coinbase removes the previous method.
Online security is almost like a hobby to me! I take great pleasure in finding solutions that keep my data in my hands, enhance my security posture, and perhaps most importantly doing all that without being a huge time / thought burden. My setup is as follows:
The only item I really need for peace of mind is backups of SyncThing. It is technically possible for a bug in SyncThing to delete all of my data. I doubt this will ever happen but I need to plan for it anyway. I'll probably end up using Google Drive or SeaFile to accomplish this.
I don't really get how yubikey helps in this case.
The major downside of having your phone stolen is worsened if you also lose the yubikey, no?
And the upside is... moving away from sms 2fa? don't most sites let you move to software 2fa, like the sites you listed?
The only advantage I see of hardware 2fa is that it automatically detects phishing attempts, so eliminates the risk of manually inputting your software 2fa into a fake site. To me that's a very low risk, since I don't see myself ever being subjected to such targetted attacks.
See this outweighed by the inconvenience of having to keep a hardware key on me, on my phone, as well as at my desktop, using my laptop or tablet on the couch or god forbid having to fumble for it late at night in bed. Or how the hell would it work on my work device, which doesn't allow non-authorised USB devices to connect?
I don't use my Yubikey all that often, just for registering new devices. It is convenient to have it on a keychain just in case. You can keep backup codes somewhere safe, but this is inconvenient if you don't have them while travelling.
All devices can break, phones definitely included. A Yubikey is cheaper and should last longer than a spare smartphone.
Maybe it's just because I read Krebs, but I don't see phishing as all that low risk these days. They are getting smarter.