@JensHannemann@mastodon.online
Post #2238406
2026-04-17 22:39 UTC
@bob_zim@infosec.exchange @encthenet@flyovercountry.social FIDO2 and Yubikeys are asymmetric. Yubikeys are just physical implementations of passkeys (they can store symmetric credentials as well, but that’s not the main application). Storing a salted hash on the server mitigates the break-in risk, which is further reduced by 2FA, but yes, strong asymmetric credentials are the best choice. Compromising every holder of secret keys just doesn’t scale.
Replies (1)
-
@bob_zim@infosec.exchange 2026-04-17 23:13
@JensHannemann@mastodon.online @encthenet@flyovercountry.social A Yubikey can store a FIDO2 credential, which is asymmetric. Their default mode programmed into slot 1, Yubico OTP, is a symmetric token based on an AES key. Salted hashes reduce the risk for users who don’t log in while the system is compromised, but if someone has access to the server, they can potentially log the cleartext passwords as users provide them.