16 ms·

Yubikey with USB-C

• CoolGuySteve 10y ago
  What is a Yubikey, I asked: "Your YubiKey provides a second factor of security for your logins, beyond a username and password. Your YubiKey needs to be registered or paired with each computer, service, or site you use it with. "
  • colept 10y ago
    It has two modes. If you short press it, it will generate a one time password. A long press will output a static password. Both modes can be configured optionally.
    • geofft 10y ago
      The newer models support U2F, which is a challenge-response thing: the website prompts you to insert your YubiKey and tap it, and the key signs a response and sends it back to your browser. I believe this adds protection against phishing because the browser communicates which origin (that is, which domain name) is sending the challenge, and that gets hashed into the signed response. So if trust-me-im-google.com proxies google.com, it can ask you for a one-time password, and the one-time password will be valid when google.com gets it, so the MITM can get your login cookie. But if you're using U2F, the signed response will say "Yes, I would like to authenticate to trust-me-im-google.com", and google.com will reject that.
      • colept 10y ago
        That's very cool. Could you elaborate on the method in which the key accepts the challenge? I was under the impression that a Yubikey only acted as a USB keyboard - which ensured it's security by isolation.
        • jffry 10y ago
          I believe they're describing U2F, and share your perception that at some point in the past these were just keyboards. [1] describes the flow at a high level, and [2] goes into more details [1]: https://www.yubico.com/about/background/fido/ https://www.yubico.com/about/background/fido/ [2]: https://developers.yubico.com/U2F/Protocol_details/Overview.html https://developers.yubico.com/U2F/Protocol_details/Overview....
        • epistasis 10y ago
          The general protocol is U2F: https://developers.yubico.com/U2F/ https://developers.yubico.com/U2F/ Yubico has some python code here: https://github.com/Yubico/python-u2flib-host https://github.com/Yubico/python-u2flib-host https://github.com/Yubico/python-u2flib-server https://github.com/Yubico/python-u2flib-server Chrome builds U2F into the browser itself for website authentication.
          • emilecantin 10y ago
            I've built a node.js version if Python is not your chosen stack: https://github.com/emilecantin/node-u2flib-server https://github.com/emilecantin/node-u2flib-server Another choice that looks (sadly, for me) more popular: https://github.com/ashtuchkin/u2f https://github.com/ashtuchkin/u2f
        • nickik 10y ago
          The other answers are correct, but even before U2F the yubikey supported other methods as well. The have a classic HMAC based ChallengeResponse-Mode, a smartcard and PIV interface.
      • nickik 10y ago
        The U2F device will not sign anything if the appId (that is the web origin/domain in most cases) is not already registered.
  • Ajedi32 10y ago
    Yeah, it's basically a smart card you can use with a bunch of popular sites like Google, GitHub, Dropbox, etc. (See http://www.dongleauth.info/ http://www.dongleauth.info/ for a more extensive list.) Based on an open standard (FIDO U2F). Some versions also support storing PGP keys and the like.
    • ghostly_s 10y ago
      Why would one prefer to use a dedicated device like this, now that smartphone-based 2nd-factor is an option?
      • Ajedi32 10y ago
        It's somewhat easier (pressing a button on a USB device vs manually typing in a short code) and more secure (malware cannot steal the key from the USB dongle, and it's physically secure against tampering).
        • ghostly_s 10y ago
          I use PingID for authentication and the manual code entry is only required as a fallback. When everything goes right, you just need to swipe to approve at the lock screen. Also, I'm doubtful there's any cause for concern about malware or physical tampering on iOS. I do like the idea of being able to plug in to authenticate for ssh on any computer, however...
      • pfg 10y ago
        Unlike TOTP, U2F devices like the Yubikey protect against phishing attacks. The more expensive (not-just-U2F) Yubikeys also work as a GPG smartcard, which you can use for things like SSH authentication.
        • chrissnell 10y ago
          Can you explain how a smartphone-generated (or received via SMS) 2FA token is susceptible to pishing or other remote theft? I like the idea of the Yubikey but I just don't see how it's any different or better from receiving, say, a Google 2FA SMS on the smartphone that's always within reach. I genuinely want to understand this so I'm hoping you or someone else can explain.
  • danjoc 10y ago
    >What is a Yubikey A yubikey 4 or Neo has 2 slots which can be configured for about 5 different things. OTP, challenge response, static password, and some other things I can't remember right now. It also has 3 slots for a PGP private key, signing key, and encryption key. It also has 4 PIV slots to use as smart card key storage for authentication (ssh), code signing, and other things I can't remember. Then there are additional PIV slots to hold expired keys you might want to keep around for some reason? It has quite a lot of functionality for a little device. The main difference between Neo and 4 is Neo has NFC, where 4 supports 4096 pgp keys. 4 is the newer one, but nothing new has NFC yet. I use it with luks for full disk encryption, ssh, and to store my pgp key for QTPass/Android Password Store. QTPass + passff extension for firefox is nice. I haven't set it up as a 2FA for sudo yet, but that's possible also. I don't plan to use it for PGP encrypted email for the same reasons described here. https://blog.filippo.io/giving-up-on-long-term-pgp/ https://blog.filippo.io/giving-up-on-long-term-pgp/
  • ruimarinho 10y ago
    I invite to take a look at the just released Yubikey Handbook (https://github.com/ruimarinho/yubikey-handbook https://github.com/ruimarinho/yubikey-handbook), an open source book on the many different Yubikey use cases and stories. Everyone of us has asked that question before :) Open to contributions as well!
• supermatou 10y ago
  Anyone else using a similar product, OTHER than Yubikey? I've read on certain forums about Yubikeys being "flimsy" and less durable than similar products; is this true? what is your experience with it?
  • colept 10y ago
    I've had mine for close to a year now, and for a while it was on my keychain daily. It has held up well!
  • michaelmcdonald 10y ago
    I have four Yubikeys (three of the "4" variant, one of the nano) and all of them are extremely durable. You'd have to purposefully try to damage one for anything to happen to it.
  • Freak_NL 10y ago
    Yubikeys actually seem pretty durable; that seems to be the gist of the opinions I've read on their durability. A piece of anecdotal evidence; I am carrying an older model Yubikey on my keyring, and it is holding up pretty well (almost two years now). They certainly don't come across as flimsy.
  • devicenull 10y ago
    I've worn out multiple USB extension cables with my Yubikey, but the device itself is still going strong.
  • dmoy 10y ago
    I have a less durable, cheaper U2F key, which is sort of the opposite of what you were asking for. I actually don't know of anything that's more durable... the yubikeys that fit inside a USB A port are pretty damn durable.
  • NuSkooler 10y ago
    I've had a YubiKey on my keychain for over a year and a half and it's held up very well. It looks quite beat up due to being in my pocket, rubbing on other keys, and so on but it works perfectly.
• modeless 10y ago
  "We are working on an additional smaller YubiKey form factor with a USB-C design akin to the YubiKey 4 Nano, but do not yet have a time frame for availability." This is what I'm waiting for. Besides lower prices. There's just no way these things should cost more than $2.
  • jeffmcjunkin 10y ago
    I'm a little dubious they can fit the Nano smarts inside the USB-C connector, like they did for USB-A. It's just so much smaller, and they didn't have a lot to work with before.
    • Johnny555 10y ago
      They can put it in a little nub outside of the connector like USB-A Wifi dongles [1] do. I don't care if it fits entirely in the USB port like the Nano, I just don't want it sticking out far enough that it'll get bent or damaged when I put my laptop in my bag. [1] https://www.adafruit.com/products/2810?gclid=CLnuoLPDq9ECFQ13fgodx5ADOQ https://www.adafruit.com/products/2810?gclid=CLnuoLPDq9ECFQ1...
  • Freak_NL 10y ago
    For the full featured Yubikey I don't particularly mind the price — it does a lot. Pure FIDO U2F keys (USB, but also NFC and Bluetooth LE) however I would very much like to see hitting a $5 or lower price point. It would enable services to introduce proper two factor authentication without breaking the bank. At the moment these keys are just a bit too expensive (Yubico's USB-only U2F key costs $18; slightly cheaper in bulk).
  • djrogers 10y ago
    > There's just no way these things should cost more than $2. Absent R&D costs, support costs, sales costs, and you know - actually making money...
    • 2bluesc 10y ago
      Don't forget things like standing behind your product and replacing it when things go wrong, because this is security after all.[1] Alternatively, I bet they could sell them for less and deny all future security issues or ask that you throw them away when they are inevitable discovered. [1] https://www.yubico.com/2015/04/yubikey-neo-openpgp-security-bug/ https://www.yubico.com/2015/04/yubikey-neo-openpgp-security-...
• jacko0 10y ago
  It would be nice to have USB C at one end and normal USB at the other.
  • Ajedi32 10y ago
    Yeah, for the moment at least USB-C isn't universal enough that I'd be comfortable carrying a key that _only_ works with devices that have USB-C ports. Maybe in a few years...
  • Perceptes 10y ago
    I recently bought a new Yubikey 4 Nano, and it came with a USB-C adapter that holds on very nicely (as in, the adapter hasn't accidentally come off the Yubikey while in my pocket). It's a good choice if you need to use your Yubikey with any non-USB-C devices.
• wonko1 10y ago
  50USD for what I'd guess is about 1USD of components. Not that this isn't justifiable... just the way it goes when most of the cash goes into development perhaps.
  • 2bluesc 10y ago
    > 50USD for what I'd guess is about 1USD of components. These are crypto hardened chips with obfuscated ASIC layouts and other details to prevent things like power line attacks and decapping. These aren't quite your run of the mill commodity chips. Furthermore, Yubico stands behind their product. When someone hacked the key with a power line analysis attack, they released updated firmware [1]. When someone hacked the OpenPGP applet that I use for SSH, they replaced my Yubikey Neo in a hassle free manner [2]. > Not that this isn't justifiable... just the way it goes when most of the cash goes into development perhaps. When you factor in the cost of pretending that security devices don't have issues and compare it to the cost of actually handling those issues, it may not be so bad. [1] https://www.yubico.com/2014/04/improvements-physical-yubikey-attacks/ https://www.yubico.com/2014/04/improvements-physical-yubikey... [2] https://www.yubico.com/2015/04/yubikey-neo-openpgp-security-bug/ https://www.yubico.com/2015/04/yubikey-neo-openpgp-security-...
    • 2bluesc 10y ago
      The chip in my Yubikey Neo appears to be a NXP A700x[0][1]. The datasheet so short it's almost useless, but it's at least something. [0] https://www.yubico.com/2015/02/big-debate-2048-4096-yubicos-stand/ https://www.yubico.com/2015/02/big-debate-2048-4096-yubicos-... [1] http://www.nxp.com/documents/short_data_sheet/A700X_FAM_SDS.pdf http://www.nxp.com/documents/short_data_sheet/A700X_FAM_SDS....
    • BostonEnginerd 10y ago
      I have a rather favorable impression of the company based in their responses to the incidents that you mentioned. They replaced my YK Neo without any hassle after the OpenPGP applet vulnerability was disclosed.
    • sllabres 10y ago
• spchampion2 10y ago
  Have they ever figured out compatibility with iOS? I feel like this is the biggest thing holding them back from broader adoption.
  • jlgaddis 10y ago
    NFC? AIUI, they can't support it until Apple does.
  • nickik 10y ago
    They are working on Bluetooth LE version. Should make it possible. But its really all the fault of apple stupid NFC police, not some other issue.
  • jsjohnst 10y ago
    Now that iOS supports USB keyboards, it might work. Not sure why I haven't tried it since that came out, but I'll give it a shot and report back.
    • eridius 10y ago
      iOS has supported USB keyboards for 6.5 years now.
      • jsjohnst 10y ago
        But it didn't provide enough USB power I thought for the Yubikey. I'd heard this changed, but I have a feeling you'd know better than me there! ;) (Long time no chat btw!)
        • eridius 10y ago
          I haven't actually researched this topic, but it looks like the current Lighting Camera Adapter (which is how you get a USB port) advertises "USB 3", so presumably that means it offers enough power (http://www.apple.com/shop/product/MK0W2AM/A/lightning-to-usb-3-camera-adapter?fnode=91 http://www.apple.com/shop/product/MK0W2AM/A/lightning-to-usb...). (Jeremy, is that you? Long time indeed!)
• cmurf 10y ago
  Couldn't there be a passthrough? I guess that means making the key a two port hub (one internal for the key itself, one external for connection additional devices).
• 2bluesc 10y ago
  I'd love to replace my YubiKey Neo with the USB-C version because it looks more rugged. That said my Neo works fine but I fear it destroying a USB port after a minor accident. However, my problem with USB-C is while it works great on my laptop, my desktop doesn't have a USB-C port anywhere near my desk or keyboard. I'd have to buy a hub or something. I'm sure this will get better as I find excuses to replace parts of my desktop hardware.
  • jsjohnst 10y ago
    Exactly my thoughts. Finally a yubikey I don't have to worry about breaking. Admittedly, I've never broke one, but I still live in fear of doing so. I'm surprised folks like the Neo though. I rarely use mine anymore as I kept accidentally triggering it when I carried my laptop to meetings.
    • AlisdairO 10y ago
      The Yubikey Nano is pretty great in this regard - doesn't stick out enough to really worry about breaking.
      • jsjohnst 10y ago
        The Nano (not Neo) is the one I was referring to (said wrong thing). It's the one I used to trigger at least once a day accidentally, usually in a chat window as luck would have it.
    • Fnoord 10y ago
      The big advantage of the Neo is NFC. As for, > I rarely use mine anymore as I kept accidentally triggering it when I carried my laptop to meetings. ..for macOS there is statusbar application called YubiSwitch [1] which allows one to enable or disable their YubiKey (default keybind Alt + Cmd + Y). It has various useful features such as timeout (default 10 sec, feature disabled by default), or locking the computer if key is removed. I use it together with a YubiKey Nano 4, with a YubiKey Neo as backup. Be sure to enter the right ProductID to make it work. You can only use one, so if you ever use your backup key you need to configure that ProductID. [1] https://github.com/pallotron/yubiswitch https://github.com/pallotron/yubiswitch
• blintz 10y ago
  No word on switching back to open source. Their YubiKey NEO was open source; not sure why insist on proprietary code for the YubiKey 4. I'm frankly not comfortable with this kind of "security by obscurity". https://github.com/Yubico/ykneo-openpgp/issues/2#issuecomment-218446368 https://github.com/Yubico/ykneo-openpgp/issues/2#issuecommen... Edit: Never mind, there's actually a reasonable explanation for the change: https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...
  • jsjohnst 10y ago
    My understanding was this had to do with a licensing issue with one of the chips they were using.
  • j_s 10y ago
    I believe it has been discussed here previously, but open source on a propietary firmware (Java VM) wouldn't be considered open source by many. https://news.ycombinator.com/item?id=11691655 https://news.ycombinator.com/item?id=11691655 It is interesting how it allowed revealing the details of a bug in the implementation, though. https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory...
    • OJFord 10y ago
      > open source on a propietary firmware (Java VM) wouldn't be considered open source It's significantly better than completely closed though!
      • yarrel 10y ago
        Why? You still can't control, fix or trust the software as a whole. It's like a parachute that almost opens.
        • rrobukef 10y ago
          Then it's at least a parachute and not a backpack with an anvil.
• arielweisberg 10y ago
  Great to hear. Seems like very fast turn around addressing the needs of USB-C. Looking forward to the snag free version.
• VA3FXP 10y ago
  A security token is an excellent concept, but usually fails when applied to 'typical' use-case scenarios. Are you military personnel who is in charge of turning the key and launching the nukes? -Excellent reason to have a key that is impossible to forge. -Also, "key discipline" is likely very high. Are you a paranoid nerd that wants to make sure that you cannot be compromised? -Excellent reason to have a key that is impossible to forge. -But what happens when you lose that security token? i.e. "Honey! I can't find the car keys, have you seen them?" We desperately need _BETTER_ 2FA. Bio-metrics are not the answer. I would be in favor of an implantable RFID chip or whatever 'better' tech comes around.
  • Fnoord 10y ago
    > But what happens when you lose that security token? Pretty simple: you use your backup key to revoke the lost key. This is possible with e.g. Lastpass and Google. Of course, if the attacker logs in before you revoke the key, you are hosed, but the same would be true in your car analogy. > i.e. "Honey! I can't find the car keys, have you seen them?" With car keys, too, you have a backup key. Arguably, the physical car keys are easier to copy. > I would be in favor of an implantable RFID chip or whatever 'better' tech comes around. Nothing new, see this article from 2004 [1]. As you can read in the article, its first headline was even in 2001 (to put in perspective this is 15 to 16 years ago). Company's name is VeriChip. The problem is that the signal can be intercepted (AFAIK it doesn't use a form of OTP), and the key cannot be easily replaced/revoked. A YubiKey doesn't suffer from this issue. The issue a YubiKey has is that it can be easier lost than an implant. The YubiKey Neo ('large' version, not the 'laptop' version) supports NFC. > We desperately need _BETTER_ 2FA. Why? How? [1] http://www.wnd.com/2004/04/24179/ http://www.wnd.com/2004/04/24179/
    • rthille 10y ago
      I'd love something like a Yubikey Neo (NFC) with a fitness band type form factor (that I can shower/swim with), and an intention indicator (button of some sort) before the NFC would respond.
      • 10y ago
• georgyo 10y ago
  Does anyone know why the yubikey 4 supports RSA 4096, but ECC only goes up to 384 and not 521? Sure 384 is likely "enough" but ECC 521 is both faster and smaller than RSA4096. I just can't seem to figure out why they would impose that limit.
  • jwatte 10y ago
    Probably a hardware limitation?
  • ChoGGi 10y ago
    Strange they mention supporting 521 here [1], but on the compare page they only list 384? [1] https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc... Edit: looking at the PIV tools manual they provide; I can see no mention of the tool supporting 521, it fails when I try to generate a key. Looking through the .h files, I do see mentions of p521 ;) int BN_nist_mod_192(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx); int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx); int BN_nist_mod_256(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx); int BN_nist_mod_384(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx); int BN_nist_mod_521(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx);
• nickik 10y ago
  What I really want is not USB-C but rather a Yubikey 4 the supports NFC. None of the sticks support all features, is quite vexing. Now I have to carry different sticks for different reasons.
  • simcop2387 10y ago
    NFC is the thing that's got me still using my Neo. It's the only reasonable way to use one with a phone for 2FA.
    • Fnoord 10y ago
      Concept itself is user friendly for mobile use. Too bad a lot of phones don't have NFC, or the NFC doesn't work with the YubiKey Neo. Given it is wireless, is it eavesdroppable?
    • BHSPitMonkey 10y ago
      Apple phones support neither USB-C nor NFC, so for those it's a non-issue. Android phones (from the last few years onward) have NFC but also have USB-C, so why exactly would you need to have both?
      • lmm 10y ago
        S7 doesn't have USB-C, and that's about as recent as it gets. And even if my phone had USB-C, NFC is more convenient.
      • simcop2387 10y ago
        My tablet doesn't have USB-C, along with that not every phone does yet either. And neither does my laptop. So I end up needing an adapter somewhere. Right now NFC makes things a lot more convenient compared to USB-C everywhere. That'll get there eventually but it's not ready yet.
• 2bluesc 10y ago
  Worth mentioning that it seems that the USB-C OpenPGP app may support RSA 4096. I'd love to upgrade my yubikey ssh key from RSA 2048 -> 4096. Currently my YubiKey Neo only supports RSA 2048 as it's a hardware limitation of the NXP A700x chip used inside. [0] https://www.yubico.com/2015/02/big-debate-2048-4096-yubicos-stand/ https://www.yubico.com/2015/02/big-debate-2048-4096-yubicos-...
  • AbacusAvenger 10y ago
    YubiKey 4 supports 4096-bit RSA. But it's not USB-C.
    • ylk 10y ago
      But that's what the article is about?... The YubiKey 4C. A YubiKey 4 that supports USB-C.
  • tptacek 10y ago
    Why? RSA-2048 isn't threatened.
  • nickik 10y ago
    All yubikey 4 support 4096 for GPG. If you use pgp auth key and gpg-agent for ssh, this is ok. The yubikey also supports PIV. There you still can only use 2048.
• newman314 10y ago
  Maybe I'm going about this the wrong way but how do people handle 2FA across multiple machines with multiple keys? I have multiple desktops, laptop and several mobile devices that I often context switch across. I'd like to use 2FA without having to plug and unplug the key every time I want to switch devices.
  • domenicd 10y ago
    You just buy a key for each and leave them permanently plugged in. Works best with the nano. (This assumes that you're OK allowing physical access to the device to count as one of the factors in 2FA, instead of e.g. physical access to your keychain or wallet or messenger bag where you would otherwise keep the key.)
  • guitarbill 10y ago
    IDK if this is the right way to go about it. But I have one long password (30 characters) for logins and disk encryption, and everything else is 1Password/2FA. If you allow cookies, you won't get asked to use the key again. Most sites allow you to also use an authenticator app on your phone (some even force you to also set this up when you add a key). And I have GPG subkeys for every machine, so the key is only needed for the initial bootstrap. So this way, the amount of times you actually have to use the key is low. I'd say I use mine one a week, maybe less.
    • tokenizerrr 10y ago
      > some even force you to also set this up when you add a key Which is a good idea if your key gets crushed.
• _joel 10y ago
  It's unfortunate that they went closed source but I still have a Neo here that survived several months in my washing machine (it got silently caught between the rubber manifold and the drum). Eventually when I found it again, plugged it in expecting nothing, but was greeted with the green flashing led and the button worked just fine. I still have it but don't use it anymore, the closed source thing grates a little with me so use other methods now.
  • j_s 10y ago
    Would you mind taking the time to share the details of your current open source authentication solution?
    • _joel 10y ago
      Yes, certainly. I ended up using TOTP with an authenticator on my phone. Try FreeOTP[1] or if you're not fussed about pure open source, Authy is worth a look. On the systems you can link it into PAM using Google's OTP plugin[2], either locally or via SSH etc. It's definitely not that ground breaking but it works, provides reasonable extra security and meets my requirements. It lacks some of the feature of Yubikey like storing GPG on there or HMAC etc, but I don't need those functions in reality. [1] https://freeotp.github.io/ https://freeotp.github.io/ [2] https://github.com/google/google-authenticator-libpam https://github.com/google/google-authenticator-libpam
• deleted 10y ago
  [deleted]
• debt 10y ago
  yubikey can still be circumvented by bribing or blackmailing a user. idk seems like another security illusion. and it's proprietary so only yubikey knows what kind of extra shit they're running on it.
• Tharre 10y ago
  It's unfortunate that there is no Yubikey nano for USB-C yet. I really like the nano form factor, especially because I can't accidentally break a USB port like I could with the normal sized one. I guess it's really hard to fit all of the electronics in a port as small as USB-C though.
  • Corrado 10y ago
    I really, Really, REALLY love my nano and can't wait for a USB-C version. Actually, that is one of the things that would make me not want a new MBP.
  • bonzini 10y ago
    I like the form factor, but as a second factor it sucks. Effectively your computer becomes the second factor, and it's much more likely that your laptop (with the Nano plugged in it) is stolen, than a keychain with a bigger Neo. It's acceptable if you only use it for OTP, but I can't get myself to put GPG private keys on a Yubikey Nano...
    • niftich 10y ago
      The Nano is essentially a Client Certificate in USB form.
    • tjohns 10y ago
      You could just put a GPG subkey on it. That way it's revokable if lost, without destroying your entire PGP key.
    • bascule 10y ago
      Why? Your GPG key is airgapped and inextricable (except possibly via something like a DPA-style attack), and you can set a PIN required to perform any private key operations, complete with a configurable number of attempts before the device wipes itself. There are DPA attacks to be worried about, but if you set a decent PIN and limit the number of failed attempts your GPG keys will probably be safe if your Yubikey is ever lost/stolen.
• joshpadnick 10y ago
  What are the options for handling loss or theft of your YubiKey if using as an individual? I love the concept of a physical token as a second auth factor, but last I checked, there were no good loss-recovery scenarios when used as an individual (versus in a corporate environment where IT manages the Yubikeys).
  • closeparen 10y ago
    Far as I can tell, the best strategy when using any 2FA system personally is to enroll at least 2 authenticators, and keep one in a safe place (preferably that a family member or trusted friend can get to while you are traveling). If either is compromised, you can use the other to log in and block it.
    • joshpadnick 10y ago
      Thanks, this makes sense. I suppose you can buy as many Yubikeys as your paranoia dictates and potentially even distribute your backups in different physical locations. Is there any potential for the Yubikeys to get "out of sync"? Or do you just initialize both Yubikeys upfront, and then distribute them to a safe place?
      • ChoGGi 10y ago
        You do them upfront, then store one in a safe place (ie: for github I have yubi and yubibackup registered)
  • nickik 10y ago
    It depends on the recovery options provided by the website. Usually they have other means, such as downloadable codes. Generally I would just buy 2 however.
  • arjie 10y ago
    I bought two and keep one 'safe'.
• jwatte 10y ago
  It needs A on one end and C on the other, because nobody I know works on only one device. (OTG too for various devices, of you want really wide compatibility)
• DCKing 10y ago
  Great! The reason I bought a Yubikey Neo over the Yubikey 4 is that I need access to the key on all my devices - computers and my phone(s). It's a way to do secure and user-friendly way to solve the key distribution problem to have access to your TOTP tokens, FIDO credentials and/or your PGP keys on all your stuff. I would not use PGP otherwise, as it leaves key distribution as an exercise to the user [2]. Since USB-C is going to be the standard on computers, phones and tablets this new product will be very versatile and usable secure authentication across almost all devices [1]. Only question is - do apps like Yubico Authenticator and OpenKeyChain support this on Android already? [1]: You're out of luck on iDevices of course, but you're out of luck with iDevices and Yubikey already. [2]: This was much less of a problem for the first ~15 years of PGP's existence of course, but it feels old-fashioned nowadays.
  • aendruk 10y ago
    I regularly use OpenKeychain with the YubiKey 4 Nano USB-C bundle on a Nexus 5X. https://www.yubico.com/product/yubikey-4-nano-usbc-bundle/ https://www.yubico.com/product/yubikey-4-nano-usbc-bundle/
• lawpoop 10y ago
  I use the yubikey, and I wish it had a blinking LED while it was in the slot, to let me know that it was still there, and should not be. The first week I had it, I left it inserted in the computer a number of times. Now I keep it on my keys so that I don't forget to remove it. Now I
• joeseeder 10y ago
  Lovely to see USB-C, I hope it will be plug and play for all USB-C phones as well!