de
nobody 1y ago

I saw people talking about putting their Bitcoin keys in yubikeys not even 2 weeks ago… nostr:note1704j6qaly6kxssg59trza396yzluaym5alkxv2kppk5px63grwuqx4a77f

Reply to this note

Please Login to reply.

Discussion

Avatar
roya ୨୧ 1y ago

that’s so fucking dumb 😭

Avatar
vnprc 1y ago

It's actually very clever. Lots of people use yubikeys for their jobs so using it as part of a multisig setup gives you plausible deniability: "That's not a hardware wallet that's what I use to sign in to github." It also improves your anonymity set: "Sorry officer, I don't know what you're talking about. I don't even own one of these 'hard wallets' or whatever you called it."

Avatar
mutatrum 1y ago

Can you make it so that it can actually sign you into GitHub as well as have a multisig part?

Avatar
vnprc 1y ago

Yep!

Avatar
vnprc 1y ago

Casa recently added yubikey support.

https://blog.casa.io/secure-your-bitcoin-with-yubikey/

Casa supports firmware versions >= 5.5. This vulnerability exists for firmware versions < 5.7. Install Yubikey Manager to check your firmware version.

https://www.yubico.com/support/download/yubikey-manager/

Avatar
Jameson Lopp 1y ago

We only started shipping Yubikeys with version 5.7 so it's probably low likelihood someone brought their own 5.5 device.

de
nobody 1y ago

Oh didn’t realize that was Casa. You guys rock so know you’re on top of it.

Avatar
Jameson Lopp 1y ago

Upon closer review it appears that the only Yubikeys with firmware version 5.5 were the Yubikey Bio, so I bet the total number of those in the wild are rather low.

de
nobody 1y ago

Do you mean Yubikeys that Casa distributed?

I just checked my 5Ci and it’s fw 5.4.3.

Avatar
𝖋𝖎𝖆𝖙𝖉𝖊𝖓𝖎𝖊𝖗 (¯`◕‿◕´¯) 1y ago

First, they need physical access

Second they need to know your pin of the yubikey

Still wouldn’t put my private key on there but no need to panic.

Just remove the keys now and use a proper HWW

de
nobody 1y ago

I’m not panicked at all. My keys are well distributed and safe.