3 ms·

It has two modes. If you short press it, it will generate a one time password. A long press will output a static password. Both modes can be configured optional

• geofft 10y ago
  The newer models support U2F, which is a challenge-response thing: the website prompts you to insert your YubiKey and tap it, and the key signs a response and sends it back to your browser. I believe this adds protection against phishing because the browser communicates which origin (that is, which domain name) is sending the challenge, and that gets hashed into the signed response. So if trust-me-im-google.com proxies google.com, it can ask you for a one-time password, and the one-time password will be valid when google.com gets it, so the MITM can get your login cookie. But if you're using U2F, the signed response will say "Yes, I would like to authenticate to trust-me-im-google.com", and google.com will reject that.
  • colept 10y ago
    That's very cool. Could you elaborate on the method in which the key accepts the challenge? I was under the impression that a Yubikey only acted as a USB keyboard - which ensured it's security by isolation.
    • jffry 10y ago
      I believe they're describing U2F, and share your perception that at some point in the past these were just keyboards. [1] describes the flow at a high level, and [2] goes into more details [1]: https://www.yubico.com/about/background/fido/ https://www.yubico.com/about/background/fido/ [2]: https://developers.yubico.com/U2F/Protocol_details/Overview.html https://developers.yubico.com/U2F/Protocol_details/Overview....
    • epistasis 10y ago
      The general protocol is U2F: https://developers.yubico.com/U2F/ https://developers.yubico.com/U2F/ Yubico has some python code here: https://github.com/Yubico/python-u2flib-host https://github.com/Yubico/python-u2flib-host https://github.com/Yubico/python-u2flib-server https://github.com/Yubico/python-u2flib-server Chrome builds U2F into the browser itself for website authentication.
      • emilecantin 10y ago
        I've built a node.js version if Python is not your chosen stack: https://github.com/emilecantin/node-u2flib-server https://github.com/emilecantin/node-u2flib-server Another choice that looks (sadly, for me) more popular: https://github.com/ashtuchkin/u2f https://github.com/ashtuchkin/u2f
    • nickik 10y ago
      The other answers are correct, but even before U2F the yubikey supported other methods as well. The have a classic HMAC based ChallengeResponse-Mode, a smartcard and PIV interface.
  • nickik 10y ago
    The U2F device will not sign anything if the appId (that is the web origin/domain in most cases) is not already registered.