Hot answers tagged

42

Well "impossible" is impossible to prove which is why in the linked answer I said "almost impossible", maybe even that is overstating it. By using a secure hardware device the attack vector goes from "malware installed remotely on host steals secret," to "attacker needs to physically gain access to the hardware device and destructively remove the private ...


21

Hardware crypto modules like this are regulated by a set of standards called FIPS 140-2 which specify the ridiculous lengths that the devices must go to in order to protect the private keys inside them. There are four levels of FIPS 140-2, briefly summarized as: Level 1: It does basic crypto-y things. Level 2: "Tamper-evident"; it's impossible to extract ...


20

The answer everyone hates: it depends on your threat model and risk appetite. What passwords are you protecting in Lastpass? Are you storing the whole password in their or a unique value to which you add a passphrase? Who are you concerned would want your passwords? Opportunistic attackers or targeted governments / organized crime? How strong is your ...


17

I have one, and I'd recommend them! I actually got it for free from the Yubico guys, when I was attending BSidesLondon. Think of it as an RSA secure-key, except much smaller, cheaper and without a battery. You get (essentially) the same security, though YubiKeys have a signficantly larger keyspace than the RSA ones. They're also incredibly sturdy, and can ...


14

My inital answer was misleading. My research of YubiKey for my original answer was shallow. I failed to find the documents on their website that provide more detailed information relevent to security analysis. Upon reviewing Security Evaluation and Key Lifecycle Management it appears that my original concerns were unfounded. Their overall process for ...


10

There are some explanations on what YubiKey does here. Basically, the password which the YubiKey "types" (from the point of view of the computer, it is a keyboard) can be either a static password, or a one-time password. If it is a static password, then you just revealed it, and it is time to be very sorry (and promptly change that password). The one-time ...


10

Have a look over here http://www.linuxjournal.com/magazine/yubikey-one-time-password-authentication The following outtake is written by Drik Mekel, author of the previously linked article: Each time you press the button on the device, it generates a one-time password and sends it to the host machine as if you had entered it on a keyboard. This password ...


7

You could wrap up the rest of the answer with "The YubiKeys implements the cryptographic smart card protocol using a programmable microcontroller". So what does this imply? Cryptographic Smart Cards The idea behind cryptographic smart cards is that they're equipped with their own crypto processor, and are able to perform several operations: create keys ...


6

I have several multifactor authnetication devices linked to my paypal account. I also have two different multi-factor authentication devices securing my stackexchange logon. It is definitely possible to do so. THere are multiple requirements to do so. One is simple convenience (I authenticate with the device nearest to me at the time). A more formal ...


6

Assuming the user has a multifactor device and forgets their password, how should that affect the "forgot password" workflow? If the user is initiating password reset from an unrecognized device/browser then a second factor of authentication should be required to perform a password reset. Best practice is to require the second factor consistently across ...


6

From the YubiCo docs: "To protect against unauthorized update of a specific configuration, a protection access code can be added. Then, in order to update or remove this configuration, the corresponding access code must be used, otherwise the request is rejected."


6

No, you are safe Even if you entered it inside a malicious computer, your key could not be compromised. It uses the same security as a credit card; meaning a smart card. This smart card contains a private key that is not disclosed unless you physically open the smart card. This is the reason why credit cards with a smart card are so much better than credit ...


5

A bit of background as to what Yubikey is first: Yubikey is a variation on a common type of device known as a One Time Password generator. Basically a mini-computer that generates an essentially unlimited stream of passwords, usually one per minute from a deterministic algorithm embedded in the device. The trick is that next password is predictable if you ...


5

Technically no, although it depends on what you mean by "secure". Usually, when using a HSM for a CA, we mean: the CA private key (usually RSA) is generated, stored and used within the HSM, and the HSM will commit honourable suicide rather than letting that key ever exit its entrails. Up to the tamper-resistance of the HSM and how bug-free its firmware is, ...


5

GnuPG 2.1.0beta2 supports signing certificates in batch mode: Support X.509 certificate creation. Using "gpgsm --genkey" allows the creation of a self-signed certificate via a new prompt. Using "gpgsm --genkey --batch" should allow the creation of arbitrary certificates controlled by a parameter file. An example parameter file is ...


5

As I understand it, Yubikey acts like a USB keyboard. You plug it in your computer, place the cursor in a form field, press the button on the Ubikey, and it sends out a text string of 44 characters to the computer like you are typing those 44 characters. The computer doesn't know the difference between you typing it or the Ubikey generating it. A website ...


5

After the private keys are on the Yubikey, they are not exportable. What you can export are secret key stubs, which practically only say this key is on a smartcard. They were the main method of making the key work on a different computer (with the smartcard), but these days, as there is sufficient information stored about the key, all you need is to use ...


4

If your user is a testuser and needs for instance access to an account with admin, a normal and a special account (not making it an admin account but also more privileges than normal). Then more than one token might be needed. Also I see this happening in practice when one single account can't perform action A and B. If the user needs access to action A ...


4

Multi-factor authentication means that you require several authentication "factors" to grant access. When the user forgets his password, or loses his token, or both, then he ceases to be able to comply to all the factors. Any method used to recover access is thus a breach in the security model. Such breaches may be tolerable if sufficiently constrained and ...


4

For a proper answer to this, many things need to be taken into consideration which are beyond the scope of this forum. Conditions like how critical it is for users to have immediate access to your application, how easy (or not) it is for users to come visit for in-person authentication, etc., will need to be weighed along with your organization's other ...


4

The YubiKey supports the Yuibco OTP, which is the long OTP generated.The YubiKey One Time Password (OTP) is a 44-character, one use, secure, 128-bit encrypted Public ID and Password, near impossible to spoof. The OTP is comprised of two major parts; the first 12 characters remain constant and represent the Public ID of the YubiKey token itself. The ...


4

YubiKey has a office in California. LastPass has one in Washington. That means that both companies are legally required to give the NSA your data should the NSA give them a National Security Letter. I see no real reason to use a closed source system like LastPass where you have to trust an US company over an open source solution like KeePass.


4

Per the Yubikey FAQ they state the following: ..."All YubiKey NEO devices manufactured as of February 10, 2015 supported the current FIDO U2F specification for NFC. To verify you have a YubiKey NEO that supports NFC, check to see your YubiKey is running firmware version 3.4.0 or later."... Likewise the YubiKey 4 (v4) and Neo (v3) are also listed as ...


3

If it is plugged into an infected computer, wouldn't the secret key be compromised? The yubikey stores the key on its internal storage media -- the exact mechanism varies depending on the type of key. When yubikey is plugged into a computer, it is recognized as a USB keyboard. Pressing the sole button on the yubikey will send a string of characters ...


3

The UUID of your cellphone isn't a meaningful second factor as it can be spoofed. On the long passwords, it is reasonably secure to use long, sentence based passwords, but the amount of security provided drops DRASTICALLY if it has anything to do with what you are connecting to. It may still seem hard to guess, but establishing a relationship rather than ...


3

The "common wisdom" that only one device is needed for an organization is a cost thing: if a token costs $60 each, and you already trust it to secure your most sensitive access, you could reuse it to provide lower access. The same token could be associated with your "admin" account, your "regular" account, and your low level "test system" account. The onus ...


3

No, this is insecure as the public identity is not considered a secret. This is backed up by the fact Yubico send the identifier over HTTP. If this is known to be used for a LastPass account, a MITM could capture the extra offline encryption key as used by LastPass. Although there is a chance that it has been leaked over the internet, as the master password ...


3

In my opinion U2F lacks one thing at the moment: The privacy of your secret key. Each device comes with it's own secret key. A site specific key is derived from this secret key to do the challenge response when logging in to a site. This is ment to keep you anonymous and easily register and authenticate at a site. But! Each U2F device that is sold nowadays ...


2

OpenSSL can theoretically use PKCS#11 modules through a specific engine add-on. But there is no PKCS#11 module for YubiKey yet. The comment alludes to something called "scute" which appears to be a PKCS#11 module which wraps around GnuPG -- as such, it may be compatible with the OpenPGP implementation for the YubiKey.


2

...for each environment Depending on the security requirements of each environment, (test, dev, qa, prod) there should be a separate token. This can prevent operational issues where a QA test script "leaks" into production and affects service. ...for each role Tokens should be unique according to the risk to operations it poses: (Domain Admin, CA admin). ...



Only top voted, non community-wiki answers of a minimum length are eligible