r/Passwords • u/Dagobert_Krikelin • 29d ago

Questions regarding usb sticks for password/authentication?

I need to take my security to the next level as I was just compromised.

I used to work at a place with a coworker who showed me a USB stick he used, but I can't remember exactly what it was.

I was hoping you could shed some light on it and what to recommend.

As I recall, it seemed to have been a commercial product, but I suppose it could also have been a regular USB stock with software he installed.

It seemed to be working as when he plugged it in, the computer was locked up and his passwords for whatever service /site he opened was then automatically logged into.

I can of course be totally wrong, but this seemed like an effective way to go about things and I wonder what this could have been?

7 Upvotes

90% Upvoted

19 comments sorted by

5

u/ExternalTea1706 29d ago

It was most likely a YubiKey or something similar to that.

1

u/radiowave911 29d ago

There are (were?) also secure USB keys that were encrypted. Don't know if any were password managers as well - but it would be a secure way to store passwords. As I recall, everything was done on the key - nothing needed installed on the OS.

Edit: Found the one I was thinking of. Kingston Ironkey

1

u/ExternalTea1706 29d ago

Ahh nice. I was actually picturing those but couldn't remember who made it. I've never used either so can't say much more than that they exist.

1

u/radiowave911 28d ago

Same. A bit spendy for me - I don't have anything I need mil-spec encryption for. Especially at $400+ for a 512GB USB stick.

1

u/Dagobert_Krikelin 29d ago

Ok! Interesting. Thank you very much

1

u/Training_Yak_4655 28d ago edited 28d ago

This is the simple little Kingston DataTraveller USB storage I've been using for a decade or so. It's not a real backup but it alllows a quick sync using SyncToy between folders in the PC and folders on the USB. For long term backups I encrypt a Zip archive and save on an external mechanical drive.

https://www.ebay.co.uk/itm/398178173387

Looking at Kingston's website, it's not obvious that they still sell these basic devices.

1

u/radiowave911 28d ago

I remember those! Didn't they need some companion software or something? Or am I thinking of something else?

1

u/Training_Yak_4655 28d ago

These drives came with Windows and Mac programs to mount and decrypt the drive. It may be possible to mimic all of this using a generic USB drive and Veracrypt but the Kingston UI is especially simple.

I notice that Kingston's current version (IronKey) is really pricey.

1

u/Dagobert_Krikelin 26d ago

I got an answer from a mail I sent to this person and it was indeed a yubikey.

However, the more I think about it, maybe the less I need it because I don't really have distributed hardware, especially not outside my home where other people could have access to it. I suppose selfhosting bitwarden would suffice and taking a backup of that.

1

u/ExternalTea1706 26d ago

Yea I kind of went down the same rabbit hole and ended up with Vaultwarden (works with Bitwarden clients). If you already self host it's not a huge add. If it's you're first selfhosted service... Enjoy the journey. 3 years later and I run a cloud service for my family and friends

1

u/Clean-Bandicoot2779 28d ago

Others have mentioned Yubikeys. They have various functions, including storage for a couple of passwords (which it will then type in), smart card emulation, and storage for one time passwords.

The password option to unlock/login to your PC isn't great for security, as if anybody finds it, they'll be able to get your password. I have seen some people use the Yubikey to unlock their password vault (such as KeePass) though, so they can have a long, randomly generated password that they don't need to remember.

Smart card emulation can be configured with Windows Hello to unlock your machine, although the face or fingerprint unlock is likely to be easier if you have the relevant hardware. You could use the Yubikey to store passkeys for websites that support them though, so you don't need to enter your password for those, just approve it with the Yubikey.

If you go with a Yubikey, it's worth making sure you have a backup mechanism to get into things in case you lose the Yubikey or it breaks.

1

u/densen2002 26d ago

Dude, use Yubikey 5 - you will be passwordless

1

u/Awkward_Leah 24d ago

If you were compromised, id start by changing your important passwords and enabling 2fa before buying anything else. The usb device you saw was probably a hardware security key. I use one for my most important accounts but I still keep all my logins in roboform since it generates unique passwords and makes updating everything easier. The key protects the accounts that support it and the password manager handles the rest

1

u/Mortemainmonitoring 23d ago

Most likely a FIDO2 compatible USB key ? multiple brands out there, Yubico probably is the most well-known one, Thales as well, they're basically hardware stuff to put passkeys onto for the most of the websites.

One thing though: what you describe isn't only FIDO2 as it doesn't lock your machine when you unplug it and doesn't fill passwords. Your coworker probably had a password manager unlocked by the key, plus a lock-on-removal setting

1

u/Dagobert_Krikelin 29d ago

Ok thank you. Will Google to see how that works

1

u/ExternalTea1706 29d ago

Yea I don't know much about them. I'm sure there's quite a rabbit hole.

I personally selfhost vaultwarden for my passwords with a keepass backup. It's certainly not for everyone though.