I am considering purchasing Yubikey devices (made by Yubico) to add two-factor authentication when my users ssh to our various servers. I figured I would configure the device to use Yubico OTP with YubiCloud (via the yubico-pam PAM module).

What are the privacy implications of doing this? Will Yubico know which users are logging into which servers and when? The OTP value includes a static identifier and the server would query YubiCloud the instant the user hits the button, so it seems like Yubico could track users as they log into various servers.

Is there anything I can do to minimize any privacy leaks? For example, can I configure my ssh servers to first try a local validation server and fall back to YubiCloud if the local validation server is unavailable? (I would want to set up some form of synchronization with YubiCloud to prevent OTP replay attacks, but I don't know if that's possible and the synchronization might negate the privacy gains from running my own validation server.)


Yubico will not know, which users are logged in. The yubikey only sends a serial number within the otp value. They use this serial number to map the AES key.

So it is not anonymous but pseudonymous. If they ever would map the identifier/serial number to the user, they know it.

But (tin foil hat mode) yubico may know which serial number they sold to you. So yubico knows, that someone of your company is logging in. They also might know this from the requesting IP address. Then they could decide to say aye or nay, not depending on the real presence of the yubikey but depending on if the FBI wants to login or not ;-) (tin foil hat mode end)

If you worry about this you can use privacyIDEA running on premise to validate all your OTP devices (in HA mode).

PAM is a mighty stack. You can configure everything you wish to. So you could configure a local authentication instance and fallthrough to the cloud service. But as mentioned above - you can also configure your local service in HA.

  • Any shared-secret based system where the vendor knows the secret is a potential risk, as per the RSA SecurID breach, of course. The cloud service just makes it more timely. PAM is indeed mighty! Here's my company's list of pam-based two-factor authentication tutorials, mostly for radius and tacacs: wikidsystems.com/support/how-to/keyword/pam-radius – nowen Feb 29 '16 at 14:45
  • You are totally right about the assymmetric keys. But you might also want to have keys in hardware. With assymmetric keys you need more complicated drivers. While the yubikey has the advantange, that the user does not need any drivers. Plus - with privacyIDEA you create and control your own key material, since you run privacyIDEA on premise. This is at least necessary if you are using symmetric keys. – cornelinux Mar 1 '16 at 17:30
  • We (WiKID, hi!) use asymmetric keys to communicate PINS one way and OTPs the other via an app, so no drivers needed. – nowen Mar 2 '16 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.