The yubikey tag has no wiki summary.
3
votes
1answer
217 views
Two-factor authentication with ssh key authentication and yubikey?
OpenSSH won't invoke PAM at all if public key (RSA)
authentication is configured and the client presents a valid key.
So if you use key-based auth, you can't enforce 2FA easily.
One workaround for ...
1
vote
2answers
302 views
How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?
Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...
7
votes
2answers
239 views
What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?
I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
7
votes
3answers
155 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
4
votes
5answers
146 views
When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?
Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
8
votes
2answers
1k views
