twitter.com/Foone/status/1576774096175521792

@JourneymanGeek, @CanadianLuke I heard some people leave YubiKeys plugged in all the time to save time. Does this make sense? Does it really hinder security that much, like don't you need to press a button on them?

Well I wouldn't leave them plugged in all the time cause anyone can press the button

Hmm. I was thinking hypothetically the longer they are plugged in the more likely an attacker/malware can compromise them.

ah no

means someone can walk in, press the button, log into your stuff and do things

those tokens are practically read only

@JourneymanGeek "What? It's a chip and I was hungry!"

lol

@northerner That sounds like someone being an idiot, unless there's a good reason for it (i.e. LMG does this kind of thing for 2FA codes for shared products; a web cam used to be pointed to an Android phone with the 2FA codes on it that their staff could RDP into and see the code they needed to log in to a web app)

besides the point here- but isn't there a better way of doing that? like VNC or another 'direct' remote viewer of the phone?

even someone with an, ahem, unsanctioned capture device

@bertieb There are lots of solutions, but they don't all work the same or as well as others. Ideally, an authenticator app that can be shared with your office staff would work in this particular instance

@CanadianLuke oO

@bertieb >_>

I was a really good photographer 😅

@bertieb or running the authenticator app in a android VM....

@bertieb the right way is to add multiple TFA devices and have the credentials stored securely