Yeah I don’t see this being an issue at all. They have to physically have my key? Oh no. Then they already have my key. And I will have disabled the key on my accounts. Unless they what, steal the key from me, take it to the lab, clone it with 11k worth of equipment, then sneak it back into my purse before I notice it’s gone? That’s some nation state espionage stuff and that is not in my threat model.
Totally a non issue unless a government arrested somebody with the intent to gain their key because : "The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. "
I see this as a non issue since it requires physical access to the key and would require them to know your email or have access to your computer.
That list of people would already be able to access your key any time anyway so they wouldn’t need to clone it 🤷🏻♀️
Yeah I don’t see this being an issue at all. They have to physically have my key? Oh no. Then they already have my key. And I will have disabled the key on my accounts. Unless they what, steal the key from me, take it to the lab, clone it with 11k worth of equipment, then sneak it back into my purse before I notice it’s gone? That’s some nation state espionage stuff and that is not in my threat model.
Totally a non issue unless a government arrested somebody with the intent to gain their key because : "The attacks require about $11,000 worth of equipment and a sophisticated understanding of electrical and cryptographic engineering. "
If they arrest someone to gain access to their key, they don’t need this attack to use their key. They can just use their key.
Sorry I was thinking of when you have yubikey setup with PIN code for access. But yeah, I guess the attack vector is clandestine theft and replace.