The yubikey tag has no wiki summary.
8
votes
2answers
1k views
7
votes
3answers
149 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
7
votes
2answers
235 views
What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?
I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
4
votes
5answers
145 views
When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?
Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
3
votes
1answer
198 views
Two-factor authentication with ssh key authentication and yubikey?
OpenSSH won't invoke PAM at all if public key (RSA)
authentication is configured and the client presents a valid key.
So if you use key-based auth, you can't enforce 2FA easily.
One workaround for ...
1
vote
2answers
287 views
How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?
Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...
