Tag Info

New answers tagged

2

Currently, the YubiKey can be setup by the user during configuration so that it is write protected. This is so the device cannot be compromised by some sort of malicious script being loaded onto it, it's also to prevent the integrity of the key being compromised as well. Although, if someone has the physical device, then really there is no need to go any ...


1

Basically what you added is like an old fashioned, physical "key" to your password storage. A "key" that no locksmith can duplicate. In your existing model the "passphrase" was the weak link. If you accidentally disclosed it, or someone shoulder surfed, or recorded your keystrokes, or you reuse it on an iffy website an attacker could get into your ...


2

You are missing some points. If someone steals a copy of your Password Safe database file they will not be able to unlock it unless they also have physical possession of your yubikey (Even if they already know what your Pass Phrase is). Of course, if an attacker has a level of access to your system where they can read memory then you are screwed as soon ...


1

The source code of password Safe is open source so you're free to do what I did: check. A HMAC takes two inputs: the key and the data. What PS does wirth the ubikey is take your input as data and send it to the UbiKey. The key is in the UbiKey itself ans stays there. So, the sequence of event is the following: You enter your passphrase. The software ...



Top 50 recent answers are included