I wanna make more of myaccounts in the internet secure with two factor. I don’t know much about it, but found out about Fido 2 and so. The security key my webbrowser shows often is the one from Yubico (BTW, I would like to get one that works with Linux, with USB and for phone with NFC) I got concerned when I noticed that Yubico is from USA, (??) Because I think NSA and thibgs like five eyes and so. Is there actually a risk that the for example is made an backdoor in the key?
The firmware is indeed closed-source, so it’s hard to audit. But they’re popular, and a security flaw wouldn’t go unnoticed for long.
There are other vendors such as NitroKey offers an alternative that offers both open source and audited hardware and software.
Thank you. I will look into it.
Don’t forget about SoloKeys!
I personally went with a yubikey because their form factor is pretty slick. I’m not to worried about damaging the key.
They’re not entirely un-auditable, either. A security flaw was discovered in the Yubikey 5 in one of the IC modules from a supplier, and they patched all of their keys from that point forward.
Unfortunately, all the 5’s from before May 2024 are unpatchable (by design to prevent thieves from having an easy way into the key), but any key purchased now should be fine.
Well shoot, I guess it’s time to get a new security key. Am I better off switching to a NitroKey?
That depends on your threat model. For most people, the attack is probably unlikely to affect them, but I would recommend reading about the flaw yourself. It’s not hard to understand.
Also, this was not the fault of Yubico but a supplier, and instead of waiting for the supplier, Yubico patched the flaw themselves by providing a custom library.
Whether you should replace your current Yubikey 5 is up to you.