I'm considering using Yubikey to log in to my Mac. However, in my threat model I have to assume that it will fall into the wrong hands, hence the question: does Yubikey have any mechanisms that prevent bruteforcing its PIN?


1 Answer 1


The YubiKey models will lock out the user after a few failed attempts, so it is reasonable to conclude that a brute force attack is not possible through any known means.


When working with the YubiKey as a smart card, by default, the PIN is locked after three unsuccessful attempts. In this case, the smart card is disabled until the user’s PIN is unlocked and the correct PIN value is entered.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .