Questions tagged [yubikey]

YubiKey is an USB authentication key developed by Yubico.

Filter by
Sorted by
Tagged with
0 votes
3 answers
88 views

Is a hardware based 2FA more resistant to phishing than SMS or TOTP?

As I understand, modern phishing is kind of like a man-in-the-middle attack. Let's say, for example that User u has an account in Domain d where he has an SMS based 2FA enabled. This is what the ...
user avatar
0 votes
0 answers
54 views

Is there an extremely easy way to use SSH with an yubikey? [closed]

Using a yubikey for SSH is pretty difficult: https://github.com/drduh/YubiKey-Guide. I mean, I can totally understand every concept in the tutorial, but I'd like it to be very very simple. Just an ...
user avatar
0 votes
1 answer
33 views

Using Yubico YubiKey 5 NFC for local data encryption

I'm interested in buying a Yubikey but want to know if you can use a Yubikey to generate a symmetric key for file encryption on selected files on a PC. Or if you need some sort of extension like HMAC-...
user avatar
  • 3
-1 votes
1 answer
171 views

How to generate SSH keys inside yubikey?

How do I generate SSH keys inside my yubikey, on Ubuntu? There seems to be nowhere to look for this info.
user avatar
0 votes
1 answer
81 views

Can I use Yubikey to encrypt a file without PGP?

I have a Yubikey 5 Series and would like to use it to encrypt a file, so that a physical presence of my Yubikey would be required to decrypt it. I know you can save a PGP key onto Yubikey and use it ...
user avatar
0 votes
1 answer
28 views

Will Lastpass ignore old 2FA tokens from the Yubikey? (tokens leaked accidentally)

Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened ...
user avatar
0 votes
1 answer
64 views

Is it possible to bruteforce Yubikey's PIN when using it as PIV/Smart card?

I'm considering using Yubikey to log in to my Mac. However, in my threat model I have to assume that it will fall into the wrong hands, hence the question: does Yubikey have any mechanisms that ...
user avatar
0 votes
0 answers
49 views

Fido U2F, can a modified client theoretically register the same key multiple times? YubiKey Wrapped PrivateKey Method

Context I was answering a question about how YubiKey can generate "infinite" keypairs for Fido U2F but doesn't need to store them locally. This leads to my initial question: Initial Question ...
user avatar
0 votes
0 answers
94 views

importing private key stub from piv card into gpg on another pc

Sorry for puzzling terminology, I'm very new to field and it's really hard to me to orient in these new things. (maybe, probably, there isn't 'private key stub' I just saw that term used somewhere, ...
user avatar
0 votes
0 answers
45 views

Is it possible to regenerate the stub private key from just the physical key in OpenSSH?

Let's say I make an id of type ed25519-sk and have it reside on my yubikey. OpenSSH makes two files, id_ed25519_sk, a stub private key, and id_ed25519_sk.pub the corresponding public key. If I lose ...
user avatar
  • 101
0 votes
0 answers
43 views

How to best support multiple hardware keys (yubikeys, etc.) as a web app?

I've implemented second factor authentication for my web app via FIDO U2F, and am testing using a Yubikey. I have read that it is best practice to associate multiple hardware keys in case one is lost, ...
user avatar
1 vote
0 answers
92 views

Using "Retired"/Extra slots (82-95) on Yubikey

Most tutorials that cover smartcard functionality of the Yubikeys use slots 9a (PIV Authentication), 9c (Digital Signature) and 9d (Key Management). However, there are also slots 82-95 (Retired Key ...
user avatar
  • 151
4 votes
0 answers
78 views

How sensitive is the primary key stub of an ed25519 security key (~/.ssh/id_ed25519_sk)?

Now that OpenSSH supports Elliptic curve security keys (since version 8.2), it's possible to generate a ed25519-sk key on a hardware security key: $ ssh-keygen -t ed25519-sk -C comment This generates ...
user avatar
  • 475
0 votes
3 answers
151 views

How could someone's account that is secured by MFA Yubikey be compromised?

Let's say that I purchased a MFA Yubikey device to secure my accounts. If an attacker wanted to compromise my accounts that are secured with this YubiKey, would this be possible without having the ...
user avatar
31 votes
3 answers
4k views

Is a USB security key trackable among websites?

If I have a security key (U2F key) like yubikey and use it on websites A and B and the owner of these two websites is the same, can the website owner know that I am the same user?
user avatar
  • 391
0 votes
1 answer
104 views

Can FIDO2 Authentication be used for native application?

I'm currently working on a project, which has a Web API, which is to be consumed by a native application. For the sake of brevity, assume that the application cannot be re-written to be a Web ...
user avatar
  • 11
0 votes
0 answers
50 views

Status of Asynchronous Remote Key Generation in the developing WebAuthn standard?

Today I read this blog entry by Yubico regarding Asynchronous Remote Key Generation. This proposal solves, in my view, the largest outstanding problem in the widescale adoption of challenge-response ...
user avatar
  • 146
1 vote
2 answers
273 views

Virtual Yubikey [closed]

If reports are to be believed, Google and others are starting to force 2FA on user accounts starting late ~2021: https://www.theverge.com/2021/10/5/22710421/google-security-2fa-inactive-account-...
user avatar
  • 27
0 votes
1 answer
98 views

Sharing Yubikey via SSH

I have a MacBook which has a Yubikey. I usually don't use my MacBook for any development. I use a remote Linux server. I would like to sign my commits with Yubikey instead of a gpg key. Can I share my ...
user avatar
  • 103
3 votes
0 answers
128 views

Move signing subkey to authentication slot on YubiKey (OpenPGP card)?

My PGP primary key is only used for certification—I use a separate subkey for signing. Like this: sec rsa4096/0x891781D0EDC66456 ...
user avatar
1 vote
0 answers
168 views

How to decrypt a KeePass database using YubiKey Challenge-Response, but without token?

Imagine the following situation: You created a KeepassXC database and secured it with a strong passphrase, as well as the HMAC-SHA1 based Challenge-Response mechanism provided by a YubiKey. The secret ...
user avatar
0 votes
2 answers
270 views

Are there still ways that OTP is safer than FIDO?

From my reading I understand that USB keys (for example Yubikeys) are more secure than OTP authentication apps (such as Google Authenticator). The primary reason is that FIDO is done without human ...
user avatar
3 votes
3 answers
531 views

A stolen security key enables full access; why are such keys considered more secure than authenticator apps?

Now that I've purchased and programmed a couple of YubiKeys, I have a question about the security and usefulness of such security keys. Assume in the following scenarios that one's username is easily ...
user avatar
0 votes
0 answers
166 views

Why my yubikey is not protected by a PIN to log into Google?

I just setted my yubikey on Google so I can login into Google without any passwords. However, I don't even have to put a PIN on the yubikey, it simply works. I find this very very dangerous as anyone ...
user avatar
0 votes
0 answers
80 views

How Does it Work - User Authentication using Yubico Smart Card (Yubico PIV) on Mac

Background: I have setup my macOS Catalina so that I can authenticate my user account using my Yubico (set up as a Smart Card) and its PIN After setting this up I can see that there are now 2 ...
user avatar
1 vote
0 answers
777 views

"Failed connecting to the YubiKey. Make sure the application has the required permissions." [closed]

I have a Yubikey version 5.2.7 and I can't generate any new certificates on yubikey manager app, which is weird since I have already generated two certs (on 9d slot) and they worked fine. Now the ...
user avatar
  • 111
0 votes
1 answer
131 views

Can yubikeys prevent cookie stealing?

When you log into a website, it stores cookies that let your browser access the website without having the password. Given that some sites support yubikey for login, does it mean that the yubikey ...
user avatar
2 votes
1 answer
923 views

How does ed25519-sk actually works?

My google-foo failed me as most "how it works" sections related to fido are very... let's say... consumer-oriented. So openssh supports U2F natively when using the appropriate elliptic-curve-...
user avatar
  • 23
1 vote
1 answer
262 views

Use local GPG key only as a backup when keycard is not available

My question is essentially the same as this one: How to force GPG to use a Keycard when it is available which asks how to force GPG to use a keycard when one is available. That question was asked in ...
user avatar
  • 146
2 votes
1 answer
628 views

GPG not recognizing YubiKey 5 NFC on Windows 10

I am trying to setup a YubiKey 5 NFC with GPG on Windows 10 to ultimately use it to sign git-commits. This is a new topic for me and I ran into some issues that got me stuck now. I ran into this error:...
user avatar
  • 121
1 vote
0 answers
170 views

What are the security risks to NFC based YubiKeys?

What are the risks of using NFC on a YubiKey versus just a hard connector? I imagine it would be possible to sniff some data off of these security keys? How real is the risk of sniffing and what could ...
user avatar
2 votes
3 answers
452 views

Why would a U2F key be more secured than an OTP device?

I have a Yubikey 5, I can store a PGP key inside, it has OTP abilities, FIDO, NFC, etc... Which is great for a device like this. First of all, I understand how a smart card is more secured than an app/...
user avatar
  • 195
2 votes
0 answers
480 views

I plugged in a yubikey containing pgp subkeys, now secret key stubs are present

Procedure: Create keypair on a live distro, upload public key, move secret subkeys to Yubikey Reboot into normal disto Plug in yubikey, and then remove it Run gpg --recv-keys HANDLE to receive public ...
user avatar
20 votes
1 answer
6k views

Is there a Yubikey equivalent to "stealing the hard drive"?

Maybe I'm essentially asking an electronics / storage question... This question is similar, though I think it was maybe asked more about physical security while the answer was more about malware. This ...
user avatar
  • 311
7 votes
3 answers
3k views

How to set up two YubiKeys to have the same secret?

A lot of services offer authentication with FIDO2, such as Twitter, but only allow the user to set one "security key". This is problematic in case the key is lost or breaks. The ideal ...
user avatar
0 votes
2 answers
168 views

Pre-paired hardware security tokens - Why don't they exist?

I've had this idea bouncing around in my head for a while, and I'm honestly surprised that it doesn't seem to be on the market. Which probably means that it wouldn't work well for some reason that ...
user avatar
1 vote
0 answers
260 views

Securing BIP39 Phrases and Password Manager Master Password

I am looking for a review of the solution to store my Ledger Nano S BIP39 recovery phrase as well as my password manager usage. This solution is mostly based on this video. Few points that I think ...
user avatar
  • 111
1 vote
1 answer
211 views

Could a malicious server compromise a Yubikey OTP and use it to login to other servers?

Let’s say I use my Yubikey OTP to login to multiple servers, and it one becomes compromised. I go to login the that compromised server, and enter my OTP. Obviously, once that’s password is verified it ...
user avatar
2 votes
0 answers
141 views

Does the USB connection have to be trusted when using Yubikey CCID/PIV?

I use a Yubikey in PIV/CCID mode. The PIN is sent from the host computer via automated script and unlocks the Yubikey PIV smartcard. In this mode, is it essential that the USB connection is trusted? ...
user avatar
0 votes
0 answers
324 views

How to have full drive encyption that is unlocked while a USB device is plugged in?

I'd like a solution that autounlocks Bitlocker, VeraCrypt or similar FDE on Windows 10 while I have a device plugged in. When it's not plugged in (or I lose/destroy the device) it should just ask for ...
user avatar
1 vote
0 answers
79 views

New Win10 and Old YubiKey4; trying to configure GPG Sign for existing key

I have been using a YubiKey 4 to sign git commits for a few years on Ubuntu. I am setting up a new Windows10 machine and want to use the same signing key from Windows; however I cannot seem to point ...
user avatar
2 votes
1 answer
681 views

Is it possible to export an expired GPG subkey's public key without signatures?

Based on Is it possible to export a GPG subkey's public component? I got familiar with: gpg --keyid-format long --with-fingerprint --list-key {e-mail} gpg --export --armor --output public-key.asc ...
user avatar
  • 131
5 votes
2 answers
952 views

Where are FIDO U2F Keys Stored?

I'm getting conflicting information on how the security keys are stored and used. Where are the public and private keys stored? If the private key is stored on the Yubikey itself, how many can it hold?...
user avatar
  • 53
-1 votes
1 answer
410 views

Why is YubiHSM an HSM?

What makes the YubiHSM an HSM? Most HSMs I have seen have more memory and are faster, perhaps due to crypto-accelerators. They're generally big and inserted in data center racks, or plugged as PCIe ...
user avatar
1 vote
1 answer
297 views

Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG

The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key. Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
user avatar
  • 1,594
1 vote
4 answers
3k views

AWS - YubiKey lost... now what?

I just received my YubiKey and was playing with it. It works brilliantly but I couldn't help thinking what would happen if I would lose the key. Well, for Google you can print out some backup codes, ...
user avatar
6 votes
1 answer
767 views

Security risks of selling a used YubiKey / Factory resetting a YubiKey

I am a proud owner of a YubiKey 5 NFC and have been using it for quite some time now. I want to replace it with another YubiKey 5 NFC running a slightly newer firmware. I have utilized almost all ...
user avatar
  • 375
4 votes
2 answers
547 views

Yubikey PGP migration

I am currently using a Yubikey 4 with my PGP subkeys on it. My mainkey is stored within Kleopatra. As I am planning to move over to a new Yubikey 5 I have asked myself if it is possible to still be ...
user avatar
0 votes
1 answer
662 views

How to use Yubikey 5 NFC for online accounts, Linux login, and KeePassXC?

I just got my Yubikey 5 NFC, and would like to use it for Linux desktop login Linux KeePassXC (which only supports hmac-sha1 challenge-response) online accounts When reading about U2F it seams to be ...
user avatar
1 vote
2 answers
357 views

Is there a way to "lock" a YubiKey after a period of inactivity?

I have a YubiKey 5c nano attached to my laptop used for 2FA, etc. It works great and is unobtrusive, but I feel like the small form factor encourages leaving it plugged into the laptop all the time, ...
user avatar
  • 1,106