2

I am looking for a way to replace my phone as a 2FA method. U2F is not universally supported. Most services that I use support TOTP (Google Authenticator), and so I thought the Yubikey would support loading the TOTP secret and, upon press of a button, somehow detect the web site I am on, generate the code, and enter it, without additional software involved. Apparently, this does not work. But could it? Or is there hardware that supports this use case?

  • As long as the website supports the hardware token, then yes. But the token and the website have to be connected somehow. That's why website owners tend to use more universally available options like Google Authenticator. Do you know that LastPass has a feature where the phone app pushes the code to your notification bar so all you have to do is tap? That is very much like a Yubikey-like functionality. – schroeder Jan 15 '17 at 12:05
4

The hardware token detects the website you're on, generates an appropriate code, and submits it directly without the user typing anything? That sounds a lot like u2f.

The reason why you don't see this offered is the same reason why only a few sites support u2f: it would require the browser to interact directly with the hardware token, and at the moment only Google Chrome is able to connect to USB devices. Other vendors don't see it as an important feature to include. Sad, because it solves phishing more or less entirely.

So no, this doesn't exist as you describe if you're not willing to use u2f. There's stuff like LastPass which can do something of what you ask, but that's a browser extension not a hardware token.

1

@tylerl is not completely right here. (Especially since U2F requires additional software ;-) The yubikey can work independently of the any driver and any website. So the yubikey will not detect a website, if not in U2F mode.

A full blown yubikey has the following modes:

  • PGP
  • U2F
  • AES yubico mode
  • HOTP
  • Challenge Response (can be used as TOTP)
  • Static password

I guess what you are amining at should be HOTP. Which is the event based mode defined in RFC 4226. TOTP is based on HOTP with time being the counter.

You can initialize the yubikey in HOTP mode and write the secret key to the yubikey. The yubikey will then work as a normal keyboard and emit the OTP value whenever you touch the button. Not matter if you are on the right website, in a browser or in notepad. => completely without any additional software and completly without the website caring about you using a yubikey.

I think there are only two challenges here:

  1. The website/application where you want to use this should support HOTP, not only TOTP.

  2. The yubikey only has two slots for this. I.e. you could only use the yubikey with two websites/applications.

  • Thanks for sharing these limitations of the Yubikey. What I don't get from answer, though, is where exactly (which statement) you don't agree with @tylerl. – bers Jan 19 '17 at 12:19
  • 1
    I am really sorry I had to read everything 3 times again. The thing I though a bit misleading with tylerl's answer was that U2F would not require additional software. To my knowledge U2F requires additional software on the client side. Where as the Yubikey in HOTP- or AES-mode does not. You could also take a look at the Nitrokey. But this one even needs more drivers. :-/ Besides I am really confused by the closing of so many topics due to "product recommendations". Soon they can close all topics, since all our live consists of products. Or we only talk scientificly or discuss protocols... – cornelinux Jan 19 '17 at 15:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.