Would you say it is more secure to use Yubikey Desktop Authenticator than Google Authenticator?

Instead of using Google Authenticator every time I want to login to some site I am wondering if it would be equally (or more) safe to use Yubikeys desktop authenticator app?

  • So, you are asking if a TOTP 2FA process is more or less secure than a token-based 2FA process? Or do you want a comparison of these specific vendor applications? – schroeder Feb 19 '18 at 21:44
  • What I want to know is if the price of conveniency from a the desktop app comes with a price of security. But I don't know if that helps your question since I cannot fully understand it. Thanks for editing my OP. – MacProGirl Feb 19 '18 at 22:27

It's hard to compare the two, but I'd say they are roughly similar when it comes to risk profiles.

An app running on your phone is generally more isolated from other apps compared to applications using standard desktop environments. A rogue smartphone app that does not have root-level access would not be able to access other application's data nor see what is being displayed on the screen. This is not true about many desktop environments where there is a lot less isolation between processes using your monitor display (especially on Linux using X, which is horrible in this regard). However, a sufficiently bad smartphone vulnerability would give attackers access to the actual pre-shared key used to generate one-time codes, so security vulnerabilities on your phone are that much worse for the purposes of safeguarding your multi-factor authentication codes. If someone steals the pre-shared key used to generate OTP codes, your account is fully compromised.

On the other hand, the Yubikey Desktop Application does not expose your actual pre-shared secret to the desktop computer, as the codes are generated directly on the Yubikey. So, even if an attacker gains access to your computer, all they would be able to obtain is the current OTP code -- which is bad, but not nearly as bad as a vulnerability of a similar scale on the smartphone.

It's up to you to weigh the upsides and downsides, but in my mind the risks are roughly similar -- therefore, using the Yubikey Desktop app backed by hardware Yubikeys is an acceptable alternative to Google Authenticator.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.