Security of LastPass + YubiKey

Question

I'm looking at password manager solutions and came across LastPass. I see they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What are the "weak links" in this scheme that could be targeted by an attack?

Answer 1

The answer everyone hates: it depends on your threat model and risk appetite.

• What passwords are you protecting in Lastpass?
• Are you storing the whole password in their or a unique value to which you add a passphrase?
• Who are you concerned would want your passwords? Opportunistic attackers or targeted governments / organized crime?
• How strong is your master password?

Software vulnerabilities can exist. Lastpass has had XSS vulnerability and a suspected intrusion recently. So yes all software can have vulnerabilities.

Yubikey as @this.josh states could also be vulnerable. Afterall if RSA got hacked and the attackers were able to use this to get into military contractors then no two factor mechanism is invulnerable.

Refer a sample attack tree for defeating two factor:

Here is a broader set [PDF]: http://www.redforcelabs.com/Documents/AnalyzingInternetSecurity.pdf

The question is are the risks acceptable to you?

Using a password manager is better than not using one and is a simple, cheap solution to improve the security of virtually any application/service you need a password for.

Using Yubikey and a strong master password greatly improves the security of whatever you store in Lastpass. The whole point of two factor is that even if one factor is compromised they still require the other. If you or the service discovers the compromise this gives you time at a minimum.

Do a quick threat model, understand your risk appetite. No system will be invulnerable but you may find the advantages to using Lastpass + Yukikey outweighs the risks for you.

Answer 2

My inital answer was misleading. My research of YubiKey for my original answer was shallow. I failed to find the documents on their website that provide more detailed information relevent to security analysis. Upon reviewing Security Evaluation and Key Lifecycle Management it appears that my original concerns were unfounded. Their overall process for delivering a secure product is sound. I apologize for problems caused by my first answer.

A quick overview (based on the documentation)

• The AES 128-bit key is generated with a "high quality pseudo random value generator".
• The computer system used in key generation is a stand-alone system with strong physical and logical access control.
• The system operators are "specially authorized"
• Key generation is performed in a "highly secure facility"
• The key records are protected with OpenPGP and transfered onto SD media
• The physical YubiKey devices are provisioned with their keys using an Initial Configuration System
• The Initial Configuration Facility is "sensitive to both theft and manipulation" (I assume this means that they have theft deterents and monitor the integirty of security critical components)
• The operators are "specially authorized and trained"
• The Initial Configuration System computers are physically and logically protected.
• The Initial Configuration System receives key records from the SD media
• After provisining a physical YubiKey the key record is "securely deleted" from the computer and the SD media
• Online validation is performed by Yubico's servers. (other service providers make requests to Yubico's servers, and they only recieve pass or fail responses).

Are there weaknesses?

There might be. If the key records are encrypted but do not include digital signatures, then an attacker could intercept the SD Media between the Key Generation facility and the Initial Configuration facility and substitute SD Media with keys known to the attacker and encrypted with the public key of the Initial Configuration facility. The documentation says protected and not 'encrypted and digitally signed', so they might only be encrypted.

The documents don't describe how equipment and hardware is verified prior to use. Or what measure are put in place to prevent operators from intentionally degrading the security of the system. My analysis is based on the provided documents. I think the overall security appears appropriate to protect resources of a non-trivial value.