Questions tagged [yubikey]
YubiKey is an USB authentication key developed by Yubico.
165
questions
0
votes
3
answers
88
views
Is a hardware based 2FA more resistant to phishing than SMS or TOTP?
As I understand, modern phishing is kind of like a man-in-the-middle attack. Let's say, for example that User u has an account in Domain d where he has an SMS based 2FA enabled. This is what the ...
0
votes
0
answers
54
views
Is there an extremely easy way to use SSH with an yubikey? [closed]
Using a yubikey for SSH is pretty difficult: https://github.com/drduh/YubiKey-Guide. I mean, I can totally understand every concept in the tutorial, but I'd like it to be very very simple. Just an ...
- 405
0
votes
1
answer
33
views
Using Yubico YubiKey 5 NFC for local data encryption
I'm interested in buying a Yubikey but want to know if you can use a Yubikey to generate a symmetric key for file encryption on selected files on a PC. Or if you need some sort of extension like HMAC-...
- 3
-1
votes
1
answer
171
views
How to generate SSH keys inside yubikey?
How do I generate SSH keys inside my yubikey, on Ubuntu?
There seems to be nowhere to look for this info.
- 405
0
votes
1
answer
81
views
Can I use Yubikey to encrypt a file without PGP?
I have a Yubikey 5 Series and would like to use it to encrypt a file, so that a physical presence of my Yubikey would be required to decrypt it.
I know you can save a PGP key onto Yubikey and use it ...
0
votes
1
answer
28
views
Will Lastpass ignore old 2FA tokens from the Yubikey? (tokens leaked accidentally)
Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened ...
- 405
0
votes
1
answer
64
views
Is it possible to bruteforce Yubikey's PIN when using it as PIV/Smart card?
I'm considering using Yubikey to log in to my Mac. However, in my threat model I have to assume that it will fall into the wrong hands, hence the question: does Yubikey have any mechanisms that ...
0
votes
0
answers
49
views
Fido U2F, can a modified client theoretically register the same key multiple times? YubiKey Wrapped PrivateKey Method
Context
I was answering a question about how YubiKey can generate "infinite" keypairs for Fido U2F but doesn't need to store them locally.
This leads to my initial question:
Initial Question
...
- 133
0
votes
0
answers
94
views
importing private key stub from piv card into gpg on another pc
Sorry for puzzling terminology, I'm very new to field and it's really hard to me to orient in these new things. (maybe, probably, there isn't 'private key stub' I just saw that term used somewhere, ...
- 101
0
votes
0
answers
45
views
Is it possible to regenerate the stub private key from just the physical key in OpenSSH?
Let's say I make an id of type ed25519-sk and have it reside on my yubikey. OpenSSH makes two files, id_ed25519_sk, a stub private key, and id_ed25519_sk.pub the corresponding public key.
If I lose ...
- 101
0
votes
0
answers
43
views
How to best support multiple hardware keys (yubikeys, etc.) as a web app?
I've implemented second factor authentication for my web app via FIDO U2F, and am testing using a Yubikey.
I have read that it is best practice to associate multiple hardware keys in case one is lost, ...
- 143
1
vote
0
answers
92
views
Using "Retired"/Extra slots (82-95) on Yubikey
Most tutorials that cover smartcard functionality of the Yubikeys use slots 9a (PIV Authentication), 9c (Digital Signature) and 9d (Key Management). However, there are also slots 82-95 (Retired Key ...
- 151
4
votes
0
answers
78
views
How sensitive is the primary key stub of an ed25519 security key (~/.ssh/id_ed25519_sk)?
Now that OpenSSH supports Elliptic curve security keys (since version 8.2), it's possible to generate a ed25519-sk key on a hardware security key:
$ ssh-keygen -t ed25519-sk -C comment
This generates ...
- 475
0
votes
3
answers
151
views
How could someone's account that is secured by MFA Yubikey be compromised?
Let's say that I purchased a MFA Yubikey device to secure my accounts. If an attacker wanted to compromise my accounts that are secured with this YubiKey, would this be possible without having the ...
- 589
31
votes
3
answers
4k
views
Is a USB security key trackable among websites?
If I have a security key (U2F key) like yubikey and use it on websites A and B and the owner of these two websites is the same, can the website owner know that I am the same user?
- 391
0
votes
1
answer
104
views
Can FIDO2 Authentication be used for native application?
I'm currently working on a project, which has a Web API, which is to be consumed by a native application. For the sake of brevity, assume that the application cannot be re-written to be a Web ...
- 11
0
votes
0
answers
50
views
Status of Asynchronous Remote Key Generation in the developing WebAuthn standard?
Today I read this blog entry by Yubico regarding Asynchronous Remote Key Generation. This proposal solves, in my view, the largest outstanding problem in the widescale adoption of challenge-response ...
- 146
1
vote
2
answers
273
views
Virtual Yubikey [closed]
If reports are to be believed, Google and others are starting to force 2FA on user accounts starting late ~2021:
https://www.theverge.com/2021/10/5/22710421/google-security-2fa-inactive-account-...
- 27
0
votes
1
answer
98
views
Sharing Yubikey via SSH
I have a MacBook which has a Yubikey. I usually don't use my MacBook for any development. I use a remote Linux server. I would like to sign my commits with Yubikey instead of a gpg key.
Can I share my ...
- 103
3
votes
0
answers
128
views
Move signing subkey to authentication slot on YubiKey (OpenPGP card)?
My PGP primary key is only used for certification—I use a separate subkey for signing. Like this:
sec rsa4096/0x891781D0EDC66456 ...
- 376
1
vote
0
answers
168
views
How to decrypt a KeePass database using YubiKey Challenge-Response, but without token?
Imagine the following situation: You created a KeepassXC database and secured it with a strong passphrase, as well as the HMAC-SHA1 based Challenge-Response mechanism provided by a YubiKey. The secret ...
- 1
0
votes
2
answers
270
views
Are there still ways that OTP is safer than FIDO?
From my reading I understand that USB keys (for example Yubikeys) are more secure than OTP authentication apps (such as Google Authenticator). The primary reason is that FIDO is done without human ...
- 253
3
votes
3
answers
531
views
A stolen security key enables full access; why are such keys considered more secure than authenticator apps?
Now that I've purchased and programmed a couple of YubiKeys, I have a question about the security and usefulness of such security keys.
Assume in the following scenarios that one's username is easily ...
- 31
0
votes
0
answers
166
views
Why my yubikey is not protected by a PIN to log into Google?
I just setted my yubikey on Google so I can login into Google without any passwords. However, I don't even have to put a PIN on the yubikey, it simply works. I find this very very dangerous as anyone ...
- 405
0
votes
0
answers
80
views
How Does it Work - User Authentication using Yubico Smart Card (Yubico PIV) on Mac
Background: I have setup my macOS Catalina so that I can authenticate my user account using my Yubico (set up as a Smart Card) and its PIN
After setting this up I can see that there are now 2 ...
1
vote
0
answers
777
views
"Failed connecting to the YubiKey. Make sure the application has the required permissions." [closed]
I have a Yubikey version 5.2.7 and I can't generate any new certificates on yubikey manager app, which is weird since I have already generated two certs (on 9d slot) and they worked fine.
Now the ...
- 111
0
votes
1
answer
131
views
Can yubikeys prevent cookie stealing?
When you log into a website, it stores cookies that let your browser access the website without having the password.
Given that some sites support yubikey for login, does it mean that the yubikey ...
- 405
2
votes
1
answer
923
views
How does ed25519-sk actually works?
My google-foo failed me as most "how it works" sections related to fido are very... let's say... consumer-oriented.
So openssh supports U2F natively when using the appropriate elliptic-curve-...
- 23
1
vote
1
answer
262
views
Use local GPG key only as a backup when keycard is not available
My question is essentially the same as this one:
How to force GPG to use a Keycard when it is available
which asks how to force GPG to use a keycard when one is available. That question was asked in ...
- 146
2
votes
1
answer
628
views
GPG not recognizing YubiKey 5 NFC on Windows 10
I am trying to setup a YubiKey 5 NFC with GPG on Windows 10 to ultimately use it to sign git-commits.
This is a new topic for me and I ran into some issues that got me stuck now.
I ran into this error:...
- 121
1
vote
0
answers
170
views
What are the security risks to NFC based YubiKeys?
What are the risks of using NFC on a YubiKey versus just a hard connector?
I imagine it would be possible to sniff some data off of these security keys? How real is the risk of sniffing and what could ...
- 113
2
votes
3
answers
452
views
Why would a U2F key be more secured than an OTP device?
I have a Yubikey 5, I can store a PGP key inside, it has OTP abilities, FIDO, NFC, etc... Which is great for a device like this.
First of all, I understand how a smart card is more secured than an app/...
- 195
2
votes
0
answers
480
views
I plugged in a yubikey containing pgp subkeys, now secret key stubs are present
Procedure:
Create keypair on a live distro, upload public key, move secret subkeys to Yubikey
Reboot into normal disto
Plug in yubikey, and then remove it
Run gpg --recv-keys HANDLE to receive public ...
- 121
20
votes
1
answer
6k
views
Is there a Yubikey equivalent to "stealing the hard drive"?
Maybe I'm essentially asking an electronics / storage question...
This question is similar, though I think it was maybe asked more about physical security while the answer was more about malware.
This ...
- 311
7
votes
3
answers
3k
views
How to set up two YubiKeys to have the same secret?
A lot of services offer authentication with FIDO2, such as Twitter, but only allow the user to set one "security key". This is problematic in case the key is lost or breaks. The ideal ...
- 1
0
votes
2
answers
168
views
Pre-paired hardware security tokens - Why don't they exist?
I've had this idea bouncing around in my head for a while, and I'm honestly surprised that it doesn't seem to be on the market. Which probably means that it wouldn't work well for some reason that ...
- 490
1
vote
0
answers
260
views
Securing BIP39 Phrases and Password Manager Master Password
I am looking for a review of the solution to store my Ledger Nano S BIP39 recovery phrase as well as my password manager usage.
This solution is mostly based on this video.
Few points that I think ...
- 111
1
vote
1
answer
211
views
Could a malicious server compromise a Yubikey OTP and use it to login to other servers?
Let’s say I use my Yubikey OTP to login to multiple servers, and it one becomes compromised. I go to login the that compromised server, and enter my OTP. Obviously, once that’s password is verified it ...
2
votes
0
answers
141
views
Does the USB connection have to be trusted when using Yubikey CCID/PIV?
I use a Yubikey in PIV/CCID mode. The PIN is sent from the host computer via automated script and unlocks the Yubikey PIV smartcard.
In this mode, is it essential that the USB connection is trusted?
...
- 121
0
votes
0
answers
324
views
How to have full drive encyption that is unlocked while a USB device is plugged in?
I'd like a solution that autounlocks Bitlocker, VeraCrypt or similar FDE on Windows 10 while I have a device plugged in. When it's not plugged in (or I lose/destroy the device) it should just ask for ...
1
vote
0
answers
79
views
New Win10 and Old YubiKey4; trying to configure GPG Sign for existing key
I have been using a YubiKey 4 to sign git commits for a few years on Ubuntu.
I am setting up a new Windows10 machine and want to use the same signing key from Windows; however I cannot seem to point ...
- 111
2
votes
1
answer
681
views
Is it possible to export an expired GPG subkey's public key without signatures?
Based on Is it possible to export a GPG subkey's public component? I got familiar with:
gpg --keyid-format long --with-fingerprint --list-key {e-mail}
gpg --export --armor --output public-key.asc ...
- 131
5
votes
2
answers
952
views
Where are FIDO U2F Keys Stored?
I'm getting conflicting information on how the security keys are stored and used. Where are the public and private keys stored? If the private key is stored on the Yubikey itself, how many can it hold?...
- 53
-1
votes
1
answer
410
views
Why is YubiHSM an HSM?
What makes the YubiHSM an HSM?
Most HSMs I have seen have more memory and are faster, perhaps due to crypto-accelerators. They're generally big and inserted in data center racks, or plugged as PCIe ...
- 167
1
vote
1
answer
297
views
Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG
The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key.
Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
- 1,594
1
vote
4
answers
3k
views
AWS - YubiKey lost... now what?
I just received my YubiKey and was playing with it. It works brilliantly but I couldn't help thinking what would happen if I would lose the key. Well, for Google you can print out some backup codes, ...
- 111
6
votes
1
answer
767
views
Security risks of selling a used YubiKey / Factory resetting a YubiKey
I am a proud owner of a YubiKey 5 NFC and have been using it for quite some time now. I want to replace it with another YubiKey 5 NFC running a slightly newer firmware. I have utilized almost all ...
- 375
4
votes
2
answers
547
views
Yubikey PGP migration
I am currently using a Yubikey 4 with my PGP subkeys on it.
My mainkey is stored within Kleopatra.
As I am planning to move over to a new Yubikey 5 I have asked myself if it is possible to still be ...
- 43
0
votes
1
answer
662
views
How to use Yubikey 5 NFC for online accounts, Linux login, and KeePassXC?
I just got my Yubikey 5 NFC, and would like to use it for
Linux desktop login
Linux KeePassXC (which only supports hmac-sha1 challenge-response)
online accounts
When reading about U2F it seams to be ...
1
vote
2
answers
357
views
Is there a way to "lock" a YubiKey after a period of inactivity?
I have a YubiKey 5c nano attached to my laptop used for 2FA, etc. It works great and is unobtrusive, but I feel like the small form factor encourages leaving it plugged into the laptop all the time, ...
- 1,106