“With the security flaw fixed, Google gave Yubico a “bug bounty” of $5,000, which the latter donated to Girls Who Code.”
Yubico is illustrating the benefits of transparency in a new blog post about a security bug recently found in the use of FIDO U2F authenticators with Google Chrome.
As Yubico’s Jesper Johansson and Venkat Venkataraju explains, the vulnerability first came to light in a news report this past March, prompting Yubico’s team to immediately investigate the issue, which revolved around the potential “to circumvent the FIDO U2F origin check using WebUSB functionality of Google Chrome.” But while the article only mentioned YubiKey NEO authenticator, the company’s team quickly found that the security flaw affected all USB key devices.
Yubico’s actions from there demonstrate the company’s community-minded approach to online security. The company brought its findings to Google and worked with the company to establish a patch, which was included in a Google Chrome update released at the end of May. With the security flaw fixed, Google gave Yubico a “bug bounty” of $5,000, which the latter donated to Girls Who Code. Then Google, in turn, matched that donation to the organization.
It’s a happy ending, and one that’s indicative of a corporate philosophy that puts end users’ security above defensive brand repair. Yubico wasn’t about to brush this issue under the rug, and the company wants to set an example for others; as its latest blog post argues, “The security ecosystem is only as strong as the weakest link and if we, as a community of vendors and security researchers effectively and respectfully work together, we can secure not only end users, but the entire ecosystem from continually evolving threats.”
And with the FIDO2 authentication standard poised to bring biometric authentication to Google Chrome and other browsers, it will be all the more important for the security community to heed that call and make sure that such technology is as effective as it can be, and that end users’ most sensitive data is protected.
Source: Yubico Blog
Follow Us