The tag has no wiki summary.

learn more… | top users | synonyms

18
votes
3answers
4k views

Security of LastPass + YubiKey

I'm looking at password manager solutions and came across LastPass. I see they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What are ...
14
votes
2answers
4k views

What is a Yubi key and how does it work?

How do Yubi keys work? Are there any alternatives?
11
votes
1answer
2k views

Two-factor authentication with ssh key authentication and yubikey?

OpenSSH won't invoke PAM at all if public key (RSA) authentication is configured and the client presents a valid key. So if you use key-based auth, you can't enforce 2FA easily. One workaround for ...
10
votes
3answers
370 views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) ...
10
votes
3answers
1k views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
7
votes
0answers
172 views

Yubikeys & SSH - which option is best for lockdown?

My company has a few dozen servers hosted on a cloud provider. All but one (OpenVPN host) is closed to the internet. We're using OpenVPN AS which uses certs + Google Authenticator for login. We are ...
5
votes
2answers
139 views

What are the weaknesses of my authentication scheme?

So, recently, after going through some infosec training (FutureLearn's Introduction to Cyber Security, which I heavily recommend as well-explained newbie material), I decided to take the plunge and ...
5
votes
2answers
3k views

How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?

Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted ...
4
votes
5answers
269 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
3
votes
2answers
586 views

Possible to use a YubiKey in HSM mode to secure a Windows CA infrastructure?

I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode. I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline ...
2
votes
1answer
33 views

What does the “configuration protection” mode do on Yubikeys?

I can't seem to find any documentation on what these options do: http://puu.sh/cGHP6/34e9b1f326.png Does this somehow offer more protection to your secret key? That is all I can think it would do. ...
2
votes
2answers
353 views

Are Yubi Keys secure “out of the box” when purchased for use with Yubi Cloud?

The YubiKey personalization tool allows someone to configure a YubiKey for HOTP, challenge response, and a variety of other authentication formats. YubiKey offers a number of personalization tools ...
2
votes
2answers
89 views

What is the purpose of yubikey

I've been doing some reading about YubiKey (for example What is a Yubi key and how does it work?) and found the information to be incomplete. It's my understanding, that when the user is prompted to ...
2
votes
1answer
278 views

How does YubiKey protects it's secret key?

From what I understand, a YubiKey stores a secret key which can be used to generate passwords to enter a server. How does a YubiKey protect it's secret key? If it is plugged into an infected ...
2
votes
0answers
599 views

FIDO, U2F Compatibility

I've been following the FIDO standard (a consumer-friendly public-key system similar to SSH key pairs) and it appears that it's close to being complete: both Google and PayPal have been testing it ...
-1
votes
1answer
109 views

Making 2 yubikeys generate the same password

Is their a way you can make two yubikeys generate the exact same password at the exact same time? (identical copy) I am wanting to purchase two of them so I am able to store a backup yubikey in a ...