I was wondering if someone providing a service can identify me (other than by IP, browser fingerprinting etc.) purely based on the code generated by the Yubikey when I touch it, if I use the same Yubikey on two different accounts.

I.e. will the provider know implicitly that the same Yubikey was used?


With Yubikey's alphanumeric one-time passwords, yes:

Each Yubikey had a unique public identifier. The authentication server must know this ID in order to select the correct AES key for the OTP. The proprietary Yubico OTP protocol should no longer be used.

With FIDO U2F, no:

The Yubikey creates a unique keypair for each combination of device+user+service. This is described in the Registration section. The FIDO protocol is newer and focuses on both secure authentication and user privacy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.