Later that evening, Stina walked over to Lars’s desk. The storm outside had finally broken, lashing rain against the windows.
Stina’s heart seized. She saw the credentials land in the attacker’s server. She saw the bot start to move, trying to replay the session. She saw the attacker attempt to log in from an IP address in Minsk.
She reached out and tapped the YubiKey. "That’s not a security device, Lars. That’s a bouncer. And it doesn't care how good your fake ID is. It only lets you in if you have the secret handshake." yubico
The attack collapsed. The bot retreated. The only thing the hackers walked away with was a useless hash of a password and a profound sense of defeat.
But Lars had something else. Tucked in his pocket, attached to his keychain next to a worn-out Lego figure, was a tiny, unassuming silver device with a blinking gold circle. A YubiKey 5 NFC. Later that evening, Stina walked over to Lars’s desk
An internal alert flashed across her terminal. A sophisticated phishing campaign was targeting her engineering team. They weren’t after credit card numbers. They were after access —the root certificates that controlled the wind turbines off the coast of Norway. If someone got in, they could destabilize the grid. In the wrong hands, a winter blackout wasn't just an inconvenience; it was a geopolitical weapon.
Lars froze. He hadn't just tried to log in from Minsk. He looked up, met Stina's eyes across the room. She gave a slow, deliberate shake of her head. Don't approve. She saw the credentials land in the attacker’s server
"It's not about the laptop," Stina said, sitting on the edge of his desk. "It's about the assumption. We assumed a password plus a code was safe. But codes can be stolen, SMS can be hijacked, and people can be tricked. That little piece of plastic? It doesn't assume anything. It just says, 'Prove you have me. Prove you are here .'"