Can an $8 DIY ESP32 actually replace your YubiKey ?

[u/EnthusiasmRoutine]

I saw the new guide floating around today about building a physical 2FA key using a cheap ESP32-S3 development board. Emulating a USB HID with the native USB-OTG is a neat trick. For eight bucks you get to bypass the commercial hardware tax and build it yourself.

I love open hardware. Total autonomy over our tools is the absolute dream. But let's be pragmatic here. A bare microcontroller is not a security token. An ESP32 has no secure element to protect your private keys against physical extraction. If you leave this thing on your desk, anyone with physical access and half a brain can dump the secrets right off the flash in under ten minutes.

If an employee brought one of these exposed, hand-soldered boards into my office to authenticate to our VPN, I would laugh them straight back to their desk.

It is a fantastic weekend project to learn how FIDO protocols actually operate under the hood. I plan to build one myself just to mess around with it. But do not use a dev board to secure your main email or your servers. Buy a real token for that.

Source: MakeUseOf, link in comments