4 ms·

What is a Yubikey, I asked: "Your YubiKey provides a second factor of security for your logins, beyond a username and password. Your YubiKey needs to be regist

What is a Yubikey, I asked: "Your YubiKey provides a second factor of security for your logins, beyond a username and password. Your YubiKey needs to be registered or paired with each computer, service, or site you use it with. "

colept 10y ago
It has two modes. If you short press it, it will generate a one time password. A long press will output a static password. Both modes can be configured optionally.
- geofft 10y ago
  The newer models support U2F, which is a challenge-response thing: the website prompts you to insert your YubiKey and tap it, and the key signs a response and sends it back to your browser. I believe this adds protection against phishing because the browser communicates which origin (that is, which domain name) is sending the challenge, and that gets hashed into the signed response. So if trust-me-im-google.com proxies google.com, it can ask you for a one-time password, and the one-time password will be valid when google.com gets it, so the MITM can get your login cookie. But if you're using U2F, the signed response will say "Yes, I would like to authenticate to trust-me-im-google.com", and google.com will reject that.
  - colept 10y ago
    That's very cool. Could you elaborate on the method in which the key accepts the challenge? I was under the impression that a Yubikey only acted as a USB keyboard - which ensured it's security by isolation.
    - jffry 10y ago
      I believe they're describing U2F, and share your perception that at some point in the past these were just keyboards. [1] describes the flow at a high level, and [2] goes into more details [1]: https://www.yubico.com/about/background/fido/ https://www.yubico.com/about/background/fido/ [2]: https://developers.yubico.com/U2F/Protocol_details/Overview.html https://developers.yubico.com/U2F/Protocol_details/Overview....
    - epistasis 10y ago
      The general protocol is U2F: https://developers.yubico.com/U2F/ https://developers.yubico.com/U2F/ Yubico has some python code here: https://github.com/Yubico/python-u2flib-host https://github.com/Yubico/python-u2flib-host https://github.com/Yubico/python-u2flib-server https://github.com/Yubico/python-u2flib-server Chrome builds U2F into the browser itself for website authentication.
      - emilecantin 10y ago
        I've built a node.js version if Python is not your chosen stack: https://github.com/emilecantin/node-u2flib-server https://github.com/emilecantin/node-u2flib-server Another choice that looks (sadly, for me) more popular: https://github.com/ashtuchkin/u2f https://github.com/ashtuchkin/u2f
    - nickik 10y ago
      The other answers are correct, but even before U2F the yubikey supported other methods as well. The have a classic HMAC based ChallengeResponse-Mode, a smartcard and PIV interface.
  - nickik 10y ago
    The U2F device will not sign anything if the appId (that is the web origin/domain in most cases) is not already registered.
Ajedi32 10y ago
Yeah, it's basically a smart card you can use with a bunch of popular sites like Google, GitHub, Dropbox, etc. (See http://www.dongleauth.info/ http://www.dongleauth.info/ for a more extensive list.) Based on an open standard (FIDO U2F). Some versions also support storing PGP keys and the like.
- ghostly_s 10y ago
  Why would one prefer to use a dedicated device like this, now that smartphone-based 2nd-factor is an option?
  - Ajedi32 10y ago
    It's somewhat easier (pressing a button on a USB device vs manually typing in a short code) and more secure (malware cannot steal the key from the USB dongle, and it's physically secure against tampering).
    - ghostly_s 10y ago
      I use PingID for authentication and the manual code entry is only required as a fallback. When everything goes right, you just need to swipe to approve at the lock screen. Also, I'm doubtful there's any cause for concern about malware or physical tampering on iOS. I do like the idea of being able to plug in to authenticate for ssh on any computer, however...
  - pfg 10y ago
    Unlike TOTP, U2F devices like the Yubikey protect against phishing attacks. The more expensive (not-just-U2F) Yubikeys also work as a GPG smartcard, which you can use for things like SSH authentication.
    - chrissnell 10y ago
      Can you explain how a smartphone-generated (or received via SMS) 2FA token is susceptible to pishing or other remote theft? I like the idea of the Yubikey but I just don't see how it's any different or better from receiving, say, a Google 2FA SMS on the smartphone that's always within reach. I genuinely want to understand this so I'm hoping you or someone else can explain.
danjoc 10y ago
>What is a Yubikey A yubikey 4 or Neo has 2 slots which can be configured for about 5 different things. OTP, challenge response, static password, and some other things I can't remember right now. It also has 3 slots for a PGP private key, signing key, and encryption key. It also has 4 PIV slots to use as smart card key storage for authentication (ssh), code signing, and other things I can't remember. Then there are additional PIV slots to hold expired keys you might want to keep around for some reason? It has quite a lot of functionality for a little device. The main difference between Neo and 4 is Neo has NFC, where 4 supports 4096 pgp keys. 4 is the newer one, but nothing new has NFC yet. I use it with luks for full disk encryption, ssh, and to store my pgp key for QTPass/Android Password Store. QTPass + passff extension for firefox is nice. I haven't set it up as a 2FA for sudo yet, but that's possible also. I don't plan to use it for PGP encrypted email for the same reasons described here. https://blog.filippo.io/giving-up-on-long-term-pgp/ https://blog.filippo.io/giving-up-on-long-term-pgp/
ruimarinho 10y ago
I invite to take a look at the just released Yubikey Handbook (https://github.com/ruimarinho/yubikey-handbook https://github.com/ruimarinho/yubikey-handbook), an open source book on the many different Yubikey use cases and stories. Everyone of us has asked that question before :) Open to contributions as well!

colept 10y ago

It has two modes. If you short press it, it will generate a one time password. A long press will output a static password. Both modes can be configured optionally.

geofft 10y ago
The newer models support U2F, which is a challenge-response thing: the website prompts you to insert your YubiKey and tap it, and the key signs a response and sends it back to your browser. I believe this adds protection against phishing because the browser communicates which origin (that is, which domain name) is sending the challenge, and that gets hashed into the signed response. So if trust-me-im-google.com proxies google.com, it can ask you for a one-time password, and the one-time password will be valid when google.com gets it, so the MITM can get your login cookie. But if you're using U2F, the signed response will say "Yes, I would like to authenticate to trust-me-im-google.com", and google.com will reject that.
- colept 10y ago
  That's very cool. Could you elaborate on the method in which the key accepts the challenge? I was under the impression that a Yubikey only acted as a USB keyboard - which ensured it's security by isolation.
  - jffry 10y ago
    I believe they're describing U2F, and share your perception that at some point in the past these were just keyboards. [1] describes the flow at a high level, and [2] goes into more details [1]: https://www.yubico.com/about/background/fido/ https://www.yubico.com/about/background/fido/ [2]: https://developers.yubico.com/U2F/Protocol_details/Overview.html https://developers.yubico.com/U2F/Protocol_details/Overview....
  - epistasis 10y ago
    The general protocol is U2F: https://developers.yubico.com/U2F/ https://developers.yubico.com/U2F/ Yubico has some python code here: https://github.com/Yubico/python-u2flib-host https://github.com/Yubico/python-u2flib-host https://github.com/Yubico/python-u2flib-server https://github.com/Yubico/python-u2flib-server Chrome builds U2F into the browser itself for website authentication.
    - emilecantin 10y ago
      I've built a node.js version if Python is not your chosen stack: https://github.com/emilecantin/node-u2flib-server https://github.com/emilecantin/node-u2flib-server Another choice that looks (sadly, for me) more popular: https://github.com/ashtuchkin/u2f https://github.com/ashtuchkin/u2f
  - nickik 10y ago
    The other answers are correct, but even before U2F the yubikey supported other methods as well. The have a classic HMAC based ChallengeResponse-Mode, a smartcard and PIV interface.
- nickik 10y ago
  The U2F device will not sign anything if the appId (that is the web origin/domain in most cases) is not already registered.

Ajedi32 10y ago

Yeah, it's basically a smart card you can use with a bunch of popular sites like Google, GitHub, Dropbox, etc. (See http://www.dongleauth.info/ http://www.dongleauth.info/ for a more extensive list.) Based on an open standard (FIDO U2F). Some versions also support storing PGP keys and the like.

ghostly_s 10y ago
Why would one prefer to use a dedicated device like this, now that smartphone-based 2nd-factor is an option?
- Ajedi32 10y ago
  It's somewhat easier (pressing a button on a USB device vs manually typing in a short code) and more secure (malware cannot steal the key from the USB dongle, and it's physically secure against tampering).
  - ghostly_s 10y ago
    I use PingID for authentication and the manual code entry is only required as a fallback. When everything goes right, you just need to swipe to approve at the lock screen. Also, I'm doubtful there's any cause for concern about malware or physical tampering on iOS. I do like the idea of being able to plug in to authenticate for ssh on any computer, however...
- pfg 10y ago
  Unlike TOTP, U2F devices like the Yubikey protect against phishing attacks. The more expensive (not-just-U2F) Yubikeys also work as a GPG smartcard, which you can use for things like SSH authentication.
  - chrissnell 10y ago
    Can you explain how a smartphone-generated (or received via SMS) 2FA token is susceptible to pishing or other remote theft? I like the idea of the Yubikey but I just don't see how it's any different or better from receiving, say, a Google 2FA SMS on the smartphone that's always within reach. I genuinely want to understand this so I'm hoping you or someone else can explain.

danjoc 10y ago

>What is a Yubikey A yubikey 4 or Neo has 2 slots which can be configured for about 5 different things. OTP, challenge response, static password, and some other things I can't remember right now. It also has 3 slots for a PGP private key, signing key, and encryption key. It also has 4 PIV slots to use as smart card key storage for authentication (ssh), code signing, and other things I can't remember. Then there are additional PIV slots to hold expired keys you might want to keep around for some reason? It has quite a lot of functionality for a little device. The main difference between Neo and 4 is Neo has NFC, where 4 supports 4096 pgp keys. 4 is the newer one, but nothing new has NFC yet. I use it with luks for full disk encryption, ssh, and to store my pgp key for QTPass/Android Password Store. QTPass + passff extension for firefox is nice. I haven't set it up as a 2FA for sudo yet, but that's possible also. I don't plan to use it for PGP encrypted email for the same reasons described here. https://blog.filippo.io/giving-up-on-long-term-pgp/ https://blog.filippo.io/giving-up-on-long-term-pgp/

ruimarinho 10y ago

I invite to take a look at the just released Yubikey Handbook (https://github.com/ruimarinho/yubikey-handbook https://github.com/ruimarinho/yubikey-handbook), an open source book on the many different Yubikey use cases and stories. Everyone of us has asked that question before :) Open to contributions as well!