Ok, here's the deal on the "YubiKey cloning attack" stuff:

Yes, a way to recover private keys from #YubiKey 5 has been found by researchers.

But the attack *requires*:

👉 *physically opening the YubiKey enclosure*

👉 physical access to the YubiKey *while it is authenticating*

👉 non-trivial electronics lab equipment

I cannot stress this enough:

✨ In basically every possible scenario you are safer using a YubiKey or a similar device, than not using one. ✨

#InfoSec #YubiKey5

Keeping your #encrypted mailbox safe & secure is our #passion. 🥰

In light of the news that Authy is discontinuing their desktop app in August of 2024, we want to let everyone know that Tuta supports all major authenticator apps & U2F keys. 🔐

No need to worry about compatibility when making the jump to a new authenticator app.🤹

👉 tuta.com/blog/posts/2fa-tutano…

#Yubikey #aegis #2FA #privacy

Thunderbird GPG Ready - E-Mails verschlüsseln und signieren

Thunderbird bietet die Möglichkeit E-Mails mit OpenPGP zu signieren und zu verschlüsseln.
Das E-Mail-Programm bietet eine übersichtliche GUI zur Verwaltung und hilft damit dem Benutzer bei der Einrichtung und der Arbeit mit der Verschlüsselung.

strobelstefan.de/blog/2023/12/…

#thunderbird #gpg #yubikey

Seems like this technique could be easily bruteforced by a dictionary attack, despite being a longer number of characters.

Personally (I'm no expert) I use a password manager. Most of my passwords are 128 characters (longer than four average words) that also use special characters, numbers, upper and lower case characters. Using a physical key such as a #Yubikey seems a better way, too.

I love #XKCD, but the advice in this strip seems kinda out of date.