Tag Info

Hot answers tagged

16

The answer everyone hates: it depends on your threat model and risk appetite. What passwords are you protecting in Lastpass? Are you storing the whole password in their or a unique value to which you add a passphrase? Who are you concerned would want your passwords? Opportunistic attackers or targeted governments / organized crime? How strong is your ...


15

I have one, and I'd recommend them! I actually got it for free from the Yubico guys, when I was attending BSidesLondon. Think of it as an RSA secure-key, except much smaller, cheaper and without a battery. You get (essentially) the same security, though YubiKeys have a signficantly larger keyspace than the RSA ones. They're also incredibly sturdy, and can ...


13

My inital answer was misleading. My research of YubiKey for my original answer was shallow. I failed to find the documents on their website that provide more detailed information relevent to security analysis. Upon reviewing Security Evaluation and Key Lifecycle Management it appears that my original concerns were unfounded. Their overall process for ...


10

There are some explanations on what YubiKey does here. Basically, the password which the YubiKey "types" (from the point of view of the computer, it is a keyboard) can be either a static password, or a one-time password. If it is a static password, then you just revealed it, and it is time to be very sorry (and promptly change that password). The one-time ...


8

Have a look over here http://www.linuxjournal.com/magazine/yubikey-one-time-password-authentication The following outtake is written by Drik Mekel, author of the previously linked article: Each time you press the button on the device, it generates a one-time password and sends it to the host machine as if you had entered it on a keyboard. This password ...


6

Assuming the user has a multifactor device and forgets their password, how should that affect the "forgot password" workflow? If the user is initiating password reset from an unrecognized device/browser then a second factor of authentication should be required to perform a password reset. Best practice is to require the second factor consistently across ...


6

I have several multifactor authnetication devices linked to my paypal account. I also have two different multi-factor authentication devices securing my stackexchange logon. It is definitely possible to do so. THere are multiple requirements to do so. One is simple convenience (I authenticate with the device nearest to me at the time). A more formal ...


5

GnuPG 2.1.0beta2 supports signing certificates in batch mode: Support X.509 certificate creation. Using "gpgsm --genkey" allows the creation of a self-signed certificate via a new prompt. Using "gpgsm --genkey --batch" should allow the creation of arbitrary certificates controlled by a parameter file. An example parameter file is ...


4

If your user is a testuser and needs for instance access to an account with admin, a normal and a special account (not making it an admin account but also more privileges than normal). Then more than one token might be needed. Also I see this happening in practice when one single account can't perform action A and B. If the user needs access to action A ...


4

Multi-factor authentication means that you require several authentication "factors" to grant access. When the user forgets his password, or loses his token, or both, then he ceases to be able to comply to all the factors. Any method used to recover access is thus a breach in the security model. Such breaches may be tolerable if sufficiently constrained and ...


4

For a proper answer to this, many things need to be taken into consideration which are beyond the scope of this forum. Conditions like how critical it is for users to have immediate access to your application, how easy (or not) it is for users to come visit for in-person authentication, etc., will need to be weighed along with your organization's other ...


4

The YubiKey supports the Yuibco OTP, which is the long OTP generated.The YubiKey One Time Password (OTP) is a 44-character, one use, secure, 128-bit encrypted Public ID and Password, near impossible to spoof. The OTP is comprised of two major parts; the first 12 characters remain constant and represent the Public ID of the YubiKey token itself. The ...


4

From the YubiCo docs: "To protect against unauthorized update of a specific configuration, a protection access code can be added. Then, in order to update or remove this configuration, the corresponding access code must be used, otherwise the request is rejected."


3

The UUID of your cellphone isn't a meaningful second factor as it can be spoofed. On the long passwords, it is reasonably secure to use long, sentence based passwords, but the amount of security provided drops DRASTICALLY if it has anything to do with what you are connecting to. It may still seem hard to guess, but establishing a relationship rather than ...


3

A bit of background as to what Yubikey is first: Yubikey is a variation on a common type of device known as a One Time Password generator. Basically a mini-computer that generates an essentially unlimited stream of passwords, usually one per minute from a deterministic algorithm embedded in the device. The trick is that next password is predictable if you ...


3

Technically no, although it depends on what you mean by "secure". Usually, when using a HSM for a CA, we mean: the CA private key (usually RSA) is generated, stored and used within the HSM, and the HSM will commit honourable suicide rather than letting that key ever exit its entrails. Up to the tamper-resistance of the HSM and how bug-free its firmware is, ...


2

...for each environment Depending on the security requirements of each environment, (test, dev, qa, prod) there should be a separate token. This can prevent operational issues where a QA test script "leaks" into production and affects service. ...for each role Tokens should be unique according to the risk to operations it poses: (Domain Admin, CA admin). ...


2

OpenSSL can theoretically use PKCS#11 modules through a specific engine add-on. But there is no PKCS#11 module for YubiKey yet. The comment alludes to something called "scute" which appears to be a PKCS#11 module which wraps around GnuPG -- as such, it may be compatible with the OpenPGP implementation for the YubiKey.


2

The "common wisdom" that only one device is needed for an organization is a cost thing: if a token costs $60 each, and you already trust it to secure your most sensitive access, you could reuse it to provide lower access. The same token could be associated with your "admin" account, your "regular" account, and your low level "test system" account. The onus ...


2

TL;DR You may be misunderstanding the security trade-offs that a YubiKey offers. All security controls involve trade-offs; YubiKeys with YubiCloud authentication involves key escrow. Authentication with YubiKeys Out of the box, YubiKeys are pre-configured to authenticate against the YubiCloud. The default mechanism appears to involve storing your AES ...


2

You're fine. You only lost a "username" type of identifier. Thomas isn't quite correct with regards to the part about the server generating 100 passwords to check. The second part, the "OTP" is encrypted. The server decrypts the OTP using it's AES key. The decrypted content has the counter. If the counter is equal to or less than the last counter the ...


2

I do very similar, and the way I see it there are two major potential points of failure and I don't really have a good solution for one of them. First major risk is that LastPass itself is hacked and it's data dumped. While data is encrypted locally, my password used to encrypt that data is not very strong. LastPass has recognized that entering in a strong ...


2

I've used DuoSecurity in the past with great success, it follows a similar method as Yubikey but allows the use of multiple authentication methods. Very easy to setup with a minimal user learning curve.


2

No, this is insecure as the public identity is not considered a secret. This is backed up by the fact Yubico send the identifier over HTTP. If this is known to be used for a LastPass account, a MITM could capture the extra offline encryption key as used by LastPass. Although there is a chance that it has been leaked over the internet, as the master password ...


1

Yubikey can either be cloud-based with Yubi providing the "yes/no" answer or you can run it locally. Run locally and benefit from the OTP.


1

If they were initialized with the same seed and had been through the same number of iterations, it's probably possible. What you should be doing is registering the two different keys to the same account. Should you lose one, invalidate it.


1

This works similarly to any symmetric key one-time password (OTP) technology. Point 1 - This is not meant to replace your password but instead be a second factor of authentication. Without possession of the Yubikey you are unable to generate the code necessary to authenticate to a system. Point 2 - Well, it generates one time passwords so it is more ...


1

YubiKey has a office in California. LastPass has one in Washington. That means that both companies are legally required to give the NSA your data should the NSA give them a National Security Letter. I see no real reason to use a closed source system like LastPass where you have to trust an US company over an open source solution like KeePass.


1

If it is plugged into an infected computer, wouldn't the secret key be compromised? The yubikey stores the key on its internal storage media -- the exact mechanism varies depending on the type of key. When yubikey is plugged into a computer, it is recognized as a USB keyboard. Pressing the sole button on the yubikey will send a string of characters ...


1

I'm not sure exactly what you want to protect if the root CA delegated signing and if it's offline. And I don't think this YubiHSM can protect x.509 out of e box, however, you might want to talk to your architect about your concerns with your CA infrastructure and read some limitations and features in the manual. manual on Yubikey HSM ...



Only top voted, non community-wiki answers of a minimum length are eligible