The attacker would need physical possession of the YubiKey, Security Key, or YubiHSM, knowledge of the accounts they want to target and specialized equipment to perform the necessary attack. Depending on the use case, the attacker may also require additional knowledge including username, PIN, account password, or authentication key.
The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. The difficulty of the attack means it would likely be carried out only by nation-states or other entities with comparable resources and then only in highly targeted scenarios. The likelihood of such an attack being used widely in the wild is extremely low.
Given this massive caveat I’d almost call that headline misleading
Adding a feature to a product that exists is much simpler than building a product you don’t have the expertise for!
I thought they were hiring Linux developers but I can’t see any open positions, hoping that means they’ve found someone rather than given up!
Their Github page looks like there’s active development, but yeah no actual releases for a long time
I quite like Neo/Omega launcher, it’s probably the best FOSS launcher I’ve found.
their development has been very slow the last year
This is the painful part. There are regressions that have been introduced which have sat their for years, and I’ve got no idea if they’ll ever be fixed. But such is the open source way, they owe me nothing and are still providing a generally good experience for free!
Dark Web Monitoring is available to all paying users of Proton Mail.
I know it’s their entire business model, but presumably they’re discovering the data for every proton email address and not just the paid ones. It would presumably cost them nothing to provide this feature to all users, I wonder what their reasoning was for making it a premium feature.
minimizing impact for people who stay off the grid
People who stay off the grid don’t have smartphones!
As much as we enthusiasts like to try and have our cake and eat it too, the only way to really be completely private/secure/anonymous is to be completely disconnected. Threat models and compromises and all that.
My personal view is that the extra security that these so-called security questions bring is worth less than the risks they bring. I’d rather the (low) risk of Bitwarden being compromised and losing the account than the (high) risk of someone searching or discovering information about me I can’t change and losing the account.
Do you consider $10,000 of equipment plus breaking your safe and extracting your pin to be easy? Who did you get on the wrong side of!?