Questions tagged [hardware-token]
The hardware-token tag has no usage guidance.
38 questions
0
votes
0
answers
91
views
What types of attacks can MFA using an hardware authenticator prevent?
I recently looked into the topic of MFA in combination with some hardware authenticator (USB keys like Nitrokey/Yubico) to potentially improve the overall security of my digital daily activities (web ...
- 1
3
votes
1
answer
1k
views
When is FIPS certification important?
I was looking at YubiKeys and noticed that they sell FIPS certified keys alongside non-FIPS certified keys. Both seem to have the same feature sets, but the FIPS certified keys are more expensive. ...
- 185
2
votes
2
answers
176
views
Can Fido2 hardware tokens be used for key agreement or Diffie-Hellman?
With Fido2 becoming more popular we see more and more affordable Fido2 hardware security keys on the market.
Can we use those tokens also for establishing a shared secret between two tokens?
I would ...
0
votes
0
answers
121
views
Passwordless authentication using expiring hardware keys
I am looking for a solution to implement passwordless authentication using expirable hardware keys. It is for devices around the world with Windows OS, and sometimes service technicians have to do ...
- 101
1
vote
1
answer
1k
views
How are hardware keys phishing resistant to man-in-the-middle attacks?
I've heard that hardware keys like Yubikey are phishing resistant. But I do not understand where a phished man-in-the-middle attack, which tries to "forward" the whole communication, fails ...
- 147
1
vote
0
answers
139
views
Hardware TOTP system-on-chip with strongly guarded seed
I am looking for hardware TOTP system-on-chip, where it would not be possible for an adversary to extract the shared secret (TOTP seed in other words). I am researching an application, where one same ...
- 111
0
votes
0
answers
121
views
Use a remote certificate (on other computer) for mTLS transaction
I have an USB Token (brand 3SKey) containing a certificate "C" with its private key stuck on a machine "A". The certificate's private key is obviously not exportable and I'm not ...
- 101
3
votes
3
answers
2k
views
Is a hardware based 2FA more resistant to phishing than SMS or TOTP?
As I understand, modern phishing is kind of like a man-in-the-middle attack. Let's say, for example that User u has an account in Domain d where he has an SMS based 2FA enabled. This is what the ...
20
votes
5
answers
4k
views
Why do some FIDO security fobs use keyboard emulation mode?
I was troubled from the very beginning by the fact that my U2F security fob acts as a keyboard and theoretically is able to press any key when no one is looking. Sometimes I accidentally touch it and ...
- 301
3
votes
1
answer
969
views
SafeNet eToken 5110CC w/ IDPrime 940MD: Generating ECC384/521 Errors + ICC/CVC Authentication
I am trying to utilize the SafeNet eToken 5110CC, which basically has the IDPrime 940MD with the applet 4.4.2.A., to generate ECC keys with lengths 384bits and 521bits to no avail.
The product brief ...
- 563
0
votes
1
answer
130
views
Protect server-side key with client token
I'd like to encrypt some data on the server using a user-managed secret. I could just ask for a password and derive a key from that, but ideally I'd like to offer users the option of using a yubikey ...
- 123
1
vote
2
answers
298
views
Pre-paired hardware security tokens - Why don't they exist?
I've had this idea bouncing around in my head for a while, and I'm honestly surprised that it doesn't seem to be on the market. Which probably means that it wouldn't work well for some reason that ...
- 520
1
vote
3
answers
345
views
Are hardware tokens secure in case of a data breach?
One of my banks authenticate me using username and an one time passcode (8 numbers) generated by a hardware token they gave to me when I opened the account.
On the surface it looks like that as long ...
- 1,985
2
votes
2
answers
323
views
use custom 'key' for hardware security token
Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (...
- 131
0
votes
1
answer
263
views
synchronization of keyfob token generator
At work, years ago, I used to have a key-fob device that was about the size of a thumb-drive. It had a 4 digit LCD screen that the numbers changed every 60 seconds. When logging onto certain servers,...
- 159
2
votes
0
answers
307
views
Cryptoki PKCS11 C_Decrypt returns shorter key (decrypted message) than expected
First off let me say I'm fully aware this question can only be answered by the token vendor but I have already contacted them and with the whole COVID situation my hopes of hearing from them soon are ...
- 196
2
votes
1
answer
261
views
Would using RSA SecurID Token across security domains introduce any weakness?
If the same hard or soft RSA SecureID token was used across security domains would this introduce any additional cryptographic weakness?
For example, if I had to access two secure customer networks ...
Jeff Arthur
1
vote
1
answer
188
views
Using a pen drive + secure certificate instead of sudo passwords
Is this recommended and/or possible? I just don't like the idea of anyone beside me being able to see when I type my password.
- 111
4
votes
0
answers
287
views
Security implications of using unfused U2F token
I noticed that both of the Feitian USB/NFC U2F Security Keys I purchased on Amazon a few years ago are unfused. This means that the pre-personalization step was partially performed but not completed ...
4
votes
1
answer
2k
views
Why does GPG --recipient only pick one (arbitrary) key for identical names, instead of all of them?
I have a recipient with four hardware keys (HKs) that they use interchangeably. These HKs contain different GPG keys that have all been generated inside and have never left the HKs, thus resulting in ...
- 49
3
votes
2
answers
261
views
RSA SecureID - is the serial of the key public?
If I am having an RSA SecureID hardware key, I can see serials/numbers at the back of the SecureID (so not the every-minute changing token)?
Is that public information? Or should the serials on the ...
- 161
1
vote
0
answers
293
views
How to reflash/reformat enterprise Aladdin eToken Pro Java 72k for own certificate? [closed]
Is this eToken can be reformatted or re-flashed for using as smart-card for authentication?
I have this stick left from my former work and wanna re-use it some way, for example, for authentication in ...
- 304
3
votes
1
answer
416
views
Good practices for protecting a machine certificate against extraction
Consider the following scenario:
You are providing VPN access for a number of machines running Windows 10.
The machines are configured and hardened according to company standards.
You rely on machine ...
- 495
0
votes
1
answer
2k
views
can a token be used for sql injection
I have a token that is restricted to read only access.
If someone obtains that token, can they use it to do a sql injection attack?
Given that the token is permissioned for read only, can someone ...
- 197
3
votes
3
answers
12k
views
Why is an HSM required to protect CA certificates (rather than a regular USB token)?
Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on.
The same vendors also offer distinct products called HSMs (...
- 3,610
4
votes
1
answer
2k
views
Create certificate without private key or using USB eToken
Considering this thread:
Create certificate without private key with OpenSSL
I have a very similar situation. I have a USB eToken 5110 JC (Aladdin) which has an inaccessible private key, since it's ...
0
votes
4
answers
989
views
Token FIPS 140-2 level 3 with support for Android, iPhone and Web
I'm testing a SafeNet 5100 token FIPS 140-2 level 3. It comes with programs to access and manage it, but only for desktop machines.
I would like to create applications that use level 3 tokens. Is ...
- 103
4
votes
1
answer
178
views
Is there a benefit to setting up a security key on an account that already has phone-based 2FA?
I'm looking at 2FA options for my Google account, and I noticed they now allow you to add a security key to your account. I'm a bit of a novice to infosec, but I'm struggling to see the benefit for me....
user43639
4
votes
3
answers
6k
views
What are dedicated TOTP devices called?
I would like to buy a device that can be provisioned with a secret seed and then displays a time based authentication token without ever revealing the seed.
As terms like 2FA, TOTP and Authenticator ...
user88348
0
votes
1
answer
224
views
One time password with Hardware Token
I am researching software authentication methods that are easy yet secure to implement in my own projects.
IDEAS: Steps to authenticate apps
The application is running from a USB drive as it is ...
- 111
8
votes
5
answers
4k
views
Hardware token vs Fingerprint based software token
I'm given a choice between two banks's authentication procedures and I need help choosing the most secure and convenient option.
Option "hardware token":
Authentication into the web platform is done ...
- 603
4
votes
0
answers
1k
views
How do security properties of Trezor's FIDO U2F differ from Yubikey?
Aside from being a bitcoin wallet, the Trezor supports FIDO U2F and seems to offer some unique benefits over a Yubikey:
The keys are always generated on the device and never rely on the manufacturer ...
- 1,710
3
votes
2
answers
828
views
Two Factor Authentication with PIN - Does where/how you enter a PIN matter?
Say I have two websites with 2FA mechanisms that are otherwise identical.
Mechanism 1
You have to enter a PIN into your Token Generator in order to retrieve your One Time Password. On the website, ...
- 181
1
vote
1
answer
194
views
inherent drawbacks of browser based OTP solutions?
We already have two sorts of OTP generators in place: (a) as hardware (token) (b) as software (e.g. Google authenticator, RedHats freeOTP)
Now I saw browser based solutions like SecureAuth OTP which ...
- 13
3
votes
2
answers
3k
views
How safe are the password prompts of the SafeNet eToken 5110 or similar cryptographic hardware tokens?
I'll need to use an hardware token, specifically the SafeNet eToken 5110 that comes with DigiCert's EV certificates, for code-signing on Windows.
I know that they issue a prompt to manually enter the ...
- 280
1
vote
0
answers
138
views
Implement 2-factor authentication with digital certificate [closed]
How can I implement digital certificate to do 2 factor authentication to a web application?
I have a web application under Apache server.
I want the application to require a digital certificate once ...
- 11
6
votes
6
answers
502
views
When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?
Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
- 51.1k
70
votes
5
answers
45k
views
What is a YubiKey and how does it work?
How do YubiKeys work? Are there any alternatives?
Here is a picture of one:
- 1,535