[rshnotsecure]

ProtonMail does not support Yubikeys. I would like to ask all of HN to think seriously about this and what this means. ProtonMail does many things exactly right. This 1 oversight suggests something very very scary going on at the organization.

HN does not allow you to delete comments. I would ask that if you think that not having Yubikeys does not require a significant and immediate answer from the ProtonMail team, to sign your name (I will) at the bottom of your response. If you can’t do that, perhaps provide a burner email address.

Dan Ehrlich

[e-mail]

CISSP, CCSP, CISM

EDIT: spacing between my signature, change of comment to commentS

[uallo]

Can you elaborate why not supporting Yubikeys (yet) "suggests something very very scary going on at the organization"?

[rshnotsecure]

Yubikeys are one of the few forms of 2FA that are highly resilient to being phished. Google has not only an option to restrict SMS 2FA, but an additional one below to restrict “all 2FA options except security keys” in GSuite.

It has been known for some time that TOTP 6 digit codes are easy to intercept. SMS Codes can also be intercepted, or gained via SSB7 vulns/ SIM jacking. This made things like Google Authenticator or Authy more resilient but certainly still quite vulnerable.

To intercept and exploit MFA in ProtonMail would absolutely trivial for a skilled single person to do. DNS poisoning + this github library would be all you needed: https://github.com/kgretzky/evilginx2

EDIT: replaced quotemark with asterisk

[uallo]

That does not really answer my question. Why does missing support for Yubikeys "suggest [that] something very very scary going on at the organization"? Supporting Yubikeys is probably already in their list of planned features. But ProtonMail is a relatively small company and the user base requesting that feature might be relatively small. Yes, security is one of their top-most priorities but so is earning money. The latter requires a large paying audience where other features might be more important.

[rshnotsecure]

It’s such an oversight that to quote someone from early 20th century ... “is this stupidity or is this treason”.

Not doing this was a deliberate choice. The benefits of implementing it outweigh at maybe a dozen orders of magnitude not implementing it.

The very scary thing btw is simple. They were bribed the same way the WordPress Core Contributors have been for years. Let me discuss this quickly, and I’m happy to name names in a separate posting (Gary Pendergast out of Australia is going to jail though along with another America dev). That being said please review this discussion where several core contributors admit to not even reading an extremely important path from arguably one of the best PHP developers in the world (certainly in terms of security): https://core.trac.wordpress.org/ticket/39309

[clairity]

you're getting no traction with your argument because you're grossly overreaching with it.

not having yubikey support is obviously not "very very scary" since most people (even on hn) don't have yubikeys and we don't run around with our tails between our legs.

many reasons can lead to not supporting yubikey yet, including the simplest, which is that it's lower on the priority list for a resource-constrained organization. or another likely explanation: yubikey has unsolved ux issues that keep it a niche product (for now), so demand simply isn't there.

this seems to be an important issue for you, so if you want to effect change, then you need to come across as well-reasoned, not fud-filled. (edit: and don't let perfect be the enemy of good.)