Tag Info

Hot answers tagged

15

The answer everyone hates: it depends on your threat model and risk appetite. What passwords are you protecting in Lastpass? Are you storing the whole password in their or a unique value to which you add a passphrase? Who are you concerned would want your passwords? Opportunistic attackers or targeted governments / organized crime? How strong is your ...


11

My inital answer was misleading. My research of YubiKey for my original answer was shallow. I failed to find the documents on their website that provide more detailed information relevent to security analysis. Upon reviewing Security Evaluation and Key Lifecycle Management it appears that my original concerns were unfounded. Their overall process for ...


11

I have one, and I'd recommend them! I actually got it for free from the Yubico guys, when I was attending BSidesLondon. Think of it as an RSA secure-key, except much smaller, cheaper and without a battery. You get (essentially) the same security, though YubiKeys have a signficantly larger keyspace than the RSA ones. They're also incredibly sturdy, and can ...


9

There are some explanations on what YubiKey does here. Basically, the password which the YubiKey "types" (from the point of view of the computer, it is a keyboard) can be either a static password, or a one-time password. If it is a static password, then you just revealed it, and it is time to be very sorry (and promptly change that password). The one-time ...


7

Have a look over here http://www.linuxjournal.com/magazine/yubikey-one-time-password-authentication The following outtake is written by Drik Mekel, author of the previously linked article: Each time you press the button on the device, it generates a one-time password and sends it to the host machine as if you had entered it on a keyboard. This password ...


6

Assuming the user has a multifactor device and forgets their password, how should that affect the "forgot password" workflow? If the user is initiating password reset from an unrecognized device/browser then a second factor of authentication should be required to perform a password reset. Best practice is to require the second factor consistently across ...


6

I have several multifactor authnetication devices linked to my paypal account. I also have two different multi-factor authentication devices securing my stackexchange logon. It is definitely possible to do so. THere are multiple requirements to do so. One is simple convenience (I authenticate with the device nearest to me at the time). A more formal ...


4

If your user is a testuser and needs for instance access to an account with admin, a normal and a special account (not making it an admin account but also more privileges than normal). Then more than one token might be needed. Also I see this happening in practice when one single account can't perform action A and B. If the user needs access to action A ...


4

Multi-factor authentication means that you require several authentication "factors" to grant access. When the user forgets his password, or loses his token, or both, then he ceases to be able to comply to all the factors. Any method used to recover access is thus a breach in the security model. Such breaches may be tolerable if sufficiently constrained and ...


4

For a proper answer to this, many things need to be taken into consideration which are beyond the scope of this forum. Conditions like how critical it is for users to have immediate access to your application, how easy (or not) it is for users to come visit for in-person authentication, etc., will need to be weighed along with your organization's other ...


4

GnuPG 2.1.0beta2 supports signing certificates in batch mode: Support X.509 certificate creation. Using "gpgsm --genkey" allows the creation of a self-signed certificate via a new prompt. Using "gpgsm --genkey --batch" should allow the creation of arbitrary certificates controlled by a parameter file. An example parameter file is ...


3

Technically no, although it depends on what you mean by "secure". Usually, when using a HSM for a CA, we mean: the CA private key (usually RSA) is generated, stored and used within the HSM, and the HSM will commit honourable suicide rather than letting that key ever exit its entrails. Up to the tamper-resistance of the HSM and how bug-free its firmware is, ...


2

...for each environment Depending on the security requirements of each environment, (test, dev, qa, prod) there should be a separate token. This can prevent operational issues where a QA test script "leaks" into production and affects service. ...for each role Tokens should be unique according to the risk to operations it poses: (Domain Admin, CA admin). ...


2

TL;DR You may be misunderstanding the security trade-offs that a YubiKey offers. All security controls involve trade-offs; YubiKeys with YubiCloud authentication involves key escrow. Authentication with YubiKeys Out of the box, YubiKeys are pre-configured to authenticate against the YubiCloud. The default mechanism appears to involve storing your AES ...


2

The YubiKey supports the Yuibco OTP, which is the long OTP generated.The YubiKey One Time Password (OTP) is a 44-character, one use, secure, 128-bit encrypted Public ID and Password, near impossible to spoof. The OTP is comprised of two major parts; the first 12 characters remain constant and represent the Public ID of the YubiKey token itself. The ...


2

The "common wisdom" that only one device is needed for an organization is a cost thing: if a token costs $60 each, and you already trust it to secure your most sensitive access, you could reuse it to provide lower access. The same token could be associated with your "admin" account, your "regular" account, and your low level "test system" account. The onus ...


2

A bit of background as to what Yubikey is first: Yubikey is a variation on a common type of device known as a One Time Password generator. Basically a mini-computer that generates an essentially unlimited stream of passwords, usually one per minute from a deterministic algorithm embedded in the device. The trick is that next password is predictable if you ...


1

If they were initialized with the same seed and had been through the same number of iterations, it's probably possible. What you should be doing is registering the two different keys to the same account. Should you lose one, invalidate it.


1

If it is plugged into an infected computer, wouldn't the secret key be compromised? The yubikey stores the key on its internal storage media -- the exact mechanism varies depending on the type of key. When yubikey is plugged into a computer, it is recognized as a USB keyboard. Pressing the sole button on the yubikey will send a string of characters ...


1

I'm not sure exactly what you want to protect if the root CA delegated signing and if it's offline. And I don't think this YubiHSM can protect x.509 out of e box, however, you might want to talk to your architect about your concerns with your CA infrastructure and read some limitations and features in the manual. manual on Yubikey HSM ...


1

I've used DuoSecurity in the past with great success, it follows a similar method as Yubikey but allows the use of multiple authentication methods. Very easy to setup with a minimal user learning curve.


1

OpenSSL can theoretically use PKCS#11 modules through a specific engine add-on. But there is no PKCS#11 module for YubiKey yet. The comment alludes to something called "scute" which appears to be a PKCS#11 module which wraps around GnuPG -- as such, it may be compatible with the OpenPGP implementation for the YubiKey.


1

The disadvantages of requiring more than two authentication factors become evident when you answer the question: "will a user need to provide all of these factors every time to access their account?". If the answer is yes, then while the system would technically become more secure (more pieces of information would have to fall into the wrong hands in order ...


1

I don't think it is reading the data from the device. This being impossible is one of the fundamental principles of such a hardware token. The UI in your screenshot gives a couple of hints that the values in those fields are not from the key. Firstly it says "auto-generated" above them. Secondly the status in the sidebar says only slot 1 is configured, but ...



Only top voted, non community-wiki answers of a minimum length are eligible