20 ms·
YubiKey 4C
- jgrahamc 10y agoWhy are Yubikeys so expensive? I have one and use them but the price always gets in the way of having more.
- AdamSC1 10y agoIn a lot of cases their clients are businesses who bulk buy the keys, brand them and provide them to their customers either for free or at a discounted price. Those companies are usually financial services, online games with monthly subscriptions, and corporate IT/Security services. So they have a high customer LTV and the investment is worth it for them. Yubico was smart to go after that market. It is costly to design, mould, manufacture, sell and support a hardware product, even something as small as this. Since you don't want your 2FA company to go out of business there is good value in knowing they have a stable business model that can actually support a company rather than just burning capital.
- deleted 10y ago[deleted]
- fuzzybeard 10y agoFor something that authenticates you for 2 factor, I'd pay a lot more. After all, this is your key you use daily for the services you live off of. The value is a no brainer.
- Ajedi32 10y agoProbably because they're capable of way more than you're using them for. The ones that just do U2F are only $18: https://www.yubico.com/products/yubikey-hardware/ https://www.yubico.com/products/yubikey-hardware/
- nickik 10y agoThey do lots of stuff. A YubiKey 4 has GPG Smartcard, U2F, PIV (SSH,CA, Windows Remote Login), Static Password, Yubikey OTP, Challenge Response Mode (HMAC) and HOTP. It does a lot of stuff, I am amazed how cheap they are. Pure U2F sticks can be done much cheaper. The Yubikey one only costs 18$, but the U2F standards was designed for cheap devices. You can get U2F sticks for less then 10$ on amazon.
- rconti 10y agoYup. they're a bargain compared to most solutions
- eecc 10y agoI still don't get how people are ok using these things without a fingerprint reader...
- bogle 10y agoWouldn't that make it 3FA? I'd need my password, my physical key and my fingerprints?
- JumpCrisscross 10y agoOne could then argue the Google Authenticator app running on my iPhone is 3FA, as one needs to be able to unlock my iPhone to access it.
- falcor84 10y agoI would definitely argue that it's 3FA. * Something you know - the service's password * Something you have - the phone with the authenticator * Something you are - your fingerprint EDITED - formatting
- _joel 10y agoThey're used as second factor authentication, not on their own and are generally linked to a TOTP/HOTP mechanism. They (depending on which technology you use) create unique, pseudo-random codes to enter (linked to some salt+time value) along with a passphrase or another auth factor (could be a smartcard of course)
- Freak_NL 10y agoWhy? This is the hardware factor in a two-factor authentication scheme. Someone purloining your YubiKey would still need a PIN or password to proceed in most 2FA schemes. The only thing biometrics would add is preventing someone from physically taking your YubiKey and abusing it along with the knowledge factor gleaned from you. That is a valid concern in some specialized cases, but certainly not the common use case 2FA aims to address. And even if it was; if someone is willing to physically intervene in your security by stealing your YubiKey, chances are they are willing to 'coerce' you to cooperate with unlocking a biometric lock as well…
- _joel 10y agoIs it still closed source?
- bogle 10y agoYes, still closed source.
- _joel 10y ago/me closes tab and gets on with day :) [edit] Interested to know why people find the need to downvote this, I asked a question and got an answer. Please enlighten me so I don't err again.
- Freak_NL 10y ago> /me closes tab and gets on with day :) Rude dismissive instant messaging language, that doesn't contribute anything to the discussion. This wouldn't have received any downvotes: > Ah shame. That's a deal breaker for me. Having open source programming on the device itself is a must-have for me because of [insert reason].
- deleted 10y ago[deleted]
- _joel 10y agoThanks for the clarification, I didn't think/mean it to be rude/dismissive but I can see how that was taken. I'll refrain from inserting IRC commands in future too :)
- js2 10y agoYubi's position on why they went closed source on the hardware seems reasonable to me: https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...
- serg_chernata 10y agoIt looks neat, can someone share personal experience or recommendations? Is this worth it? Is there a better alternative?
- cafebabbe 10y agoHad one, loved it, then lost it, then hated it.
- baq 10y agothat's why you always have to have two, preferably 3 - one stored off site somewhere. physical locks also come with at least 3 keys.
- simias 10y agoI use a Yubikey 4 with the GnuPG smartcard applet to secure all my password, sign my emails and connect to remote computers with SSH. It's super convenient and I'd never go back. That being said I got a bit concerned about the use of closed source components in newer yubikeys (I believe that the yubikey 4 is open source and the later ones aren't, but don't trust me on that). For this reason I also bought a nitrokey as a backup. It's a bit slower than the yubikey (I use 4096bit keys) but it works well. I really don't like the plastic cap on the nitrokey though, I feel like I'd lose it within a week if I started using it as my main key. The Yubikey doesn't have any protection at all but it looks sturdy enough that it doesn't really matter. It's been on my keyring for months and it seems to handle the abuse just fine.
- jordskott 10y agoTo be honest, Yubikey was never really open source. Sure, they open sourced _some_ compomnents before but you coulnd't do anything with the source.
- baccredited 10y agoDo any of these RSA alternatives have an LCD display showing the id? Our work computers are locked down and USB is not an option.
- drewg123 10y agoThe OTP functions basically as a USB HID keyboard. So you can plug it into something that is not locked down (like a phone or tablet), and then just copy the code. The drawback is that the code could be long. A few years ago, the codes were just 6 digits. My latest nano spits out a very long (20 char?) alpha-numeric string.
- pmoriarty 10y agoI wouldn't mind a 20 char string. I regularly type passphrases significantly longer than that.
- fuzzybeard 10y agoIs it just Mass Storage that'd disabled in USB or the ports themselves?
- jalude 10y agoYou can have it behave like a keyboard and simply 'type' the characters of the one time password in. I don't know how locked down your systems but usually keyboards are allowed.
- NikolaNovak 10y agoDo they work any better on iPhones? ----- I decided couple of months ago to secure entire family. Bought half dozen Neos, worked out all the kinks on my computer + Android phone first, put everything in LastPass (I know, I know, I know... but you have to consider the target audience ;).... only to discover on "go-live" that my wife's iPhone 6s is bloody useless with the thing. Apparently iPhone doesn't fully grok NFC or something? Not sure... :-/
- Freak_NL 10y agoApple decided that users cannot use the NFC chip in it except for Apple Pay (for the foreseeable future). You don't really 'own' an Iphone in that sense.
- NikolaNovak 10y agousers cannot use the NFC chip in it except for Apple Pay That... boggles my mind :-O Thanks for the info. My wife is unfortunately locked into iPhone due to work standard, but something to keep in mind long-term.
- _1tan 10y agoThat's it - iPhone is the new Blackberry.
- nickik 10y agoFor U2F at least, Bluetooth solutions should be arriving. If Yubico does its on (they have said that they are working on it) they might additionally let you use the OTP stuff. That said, LassPass says that when Firefox supports U2F, they will also try to support it. So maybe the OTP stuff is not that important. Dashlane Password Manager already supports it.
- artursapek 10y agoSeriously?
- 10y ago
- Nullabillity 10y agoKind of useless to have a C-only device this early. An A/C-hybrid would be much more useful, like Kingston's MicroDuo[1] series. [1]: http://www.kingston.com/us/usb/personal_business/DTDUO3C http://www.kingston.com/us/usb/personal_business/DTDUO3C
- kentiko 10y agoIt's an authentication key, not a flash drive.
- michaelmior 10y agoThe same point still applies.
- andresgottlieb 10y agoIt's a comment, not a logical proof
- snovv_crash 10y agoThat doesn't change the fact that you may still need to use it in a friend's computer, or at an internet café.
- amichal 10y ago..or from YubiKey for 1$ more (then their USB c version) https://www.yubico.com/product/yubikey-4-nano-usbc-bundle/ https://www.yubico.com/product/yubikey-4-nano-usbc-bundle/
- deleted 10y ago[deleted]
- epistasis 10y agoCould you explain why you think that? The audience for this is people that primarily use C-only devices; it was requested by customers. I don't see the point of a dual device except to add size and expense. I'd rather just go with a dongle, as it can be reused.
- tckr 10y agoMake the price $5 and these will sell.
- danjoc 10y agoSometimes they do. They did when they launched yubikeys on github. You could get a yubikey with github logo on it for $5, limit 2. They were U2F only, but I still purchased two for the novelty.
- monatron 10y agoPresumably they sell at their current price, why drop it?
- nickik 10y agoThese keys will never be $5 but pure U2F only keys are almost already there. You can get U2F keys for 8-10$ already.
- abhv 10y agoalternative is u2fzero, available on amazon for 8$, and totally open source. the difference is that yubi uses an nxp secure coprocessor, whereas the u2fzero uses atmel. there is the possibility of side-channel attacks on the u2fzero. but for your family, it is better than nothing and much more cost effective.
- Freak_NL 10y ago> […] there is the possibility of side-channel attacks on the u2fzero. Interesting. How does that work? Have you any references to that?
- adrianN 10y agohttps://github.com/conorpp/u2f-zero/wiki/Security-Overview https://github.com/conorpp/u2f-zero/wiki/Security-Overview
- abhv 10y agoThe Atmel chips do not claim that they have implemented counter-measures for power analysis, etc. Power analysis on a key operation is a dangerous attack if proper counter-measures are not taken. You can literally read off the 0/1 of each bit of the key as the key operation is underway if you monitor the power/timing. The NXP chips inside the yubikey claim to be hardened against several such attacks (although I have not confirmed). NXP is a cagey company. For example, I am a researcher, and I wanted to get the yubi-key's unlocked to write and test new u2f protocols on their hardware. They wouldnt sell me development keys, and claimed that the restriction was placed on them by NXP. I wrote half-a-dozen requests to the NXP people, and they never replied.
- Tomdarkness 10y agoThe Yubikey 4 does a lot more than just U2F though.
- ckok 10y agoYou have a link? The only thing I get for u2fzero is their site with instructions on how to build one.
- jupp0r 10y agoUntil there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats the whole point.
- LeifCarrotson 10y ago> Not having it inserted defeats the whole point How so? I would keep this on a keychain or lanyard (it looks rugged enough to handle that sort of environment). When I need to authenticate, I plug it in, when I'm done, I unplug it. That seems a lot more secure than leaving it in the computer all the time. If someone gets my computer and the YubiKey is always installed, that sort of defeats the purpose of having a separate hardware security device. In that case, why not just use Keypass?
- eumoria 10y agoI've had the standard USB version on my keys for about a year at this point. They're in my back pocket and take a bunch of abuse. Still works just fine.
- sdwisely 10y agoYup, mine has been on my keys and in use for nearly 6 years now and it works just as well as it did the day I bought it.
- nickik 10y agoDirect physical access to your computer is not the only thread. Even if you have in your computer all the time it gives you better logins, easier and safer. Specially protection from phishing. When I leave my computer out of my eyes it usually locked (unlock with password), so I don't expect somebody to quickly go in and do something. If I leave for longer, I sometimes pull the Nano out and put it somewhere I don't lose it for a while. The advantage of your system is that you can use the U2F screen unlock instead of the password.
- akulbe 10y ago
- ionised 10y agoWhat are the current alternatives to Yubikey? Preferably looking for something open-source and in no way associated with Google.
- bb88 10y agoThe U2F zero was on amazon for a while. But not anymore. Unfortunately the guy who is doing it no longer has time for it.
- mstade 10y agoWait – Yubikey is associated with Google? Or did you mean that whatever alternatives people suggest mustn't be associated with Google?
- nickik 10y agoThere are some connections. The people who founded it. Google are early investors. Google are also one of the most important costumers. I think that makes it even more secure. Google house lots of people running around with these.
- pmoriarty 10y ago"I think that makes it even more secure." That reminds me of how for a long time people were saying that encryption influenced and blessed by the NSA must be secure because government agencies were using it and the NSA wouldn't weaken their encryption. Turns out they did.
- hollander 10y agoI have a Yubikey, but almost never use it. I still don't get it fully, don't have a use-case where it totally works for me. Having one key is maybe part of the problem. If I lose it, what then?
- danjoc 10y agoWhen I first got mine, I was the same way. I learned different bits in steps. First was yubikey-luks for full disk encryption. Then using my ssh key on it. Then GPG key on it. Then using GPG key for password storage with QTPass, OpenKeychain/Android Password Store. Then 2FA with gmail. I'm getting a lot more use out of mine more than a year after originally getting it.
- johnnycarcin 10y agoFor the ssh key, are you using your yubikey on multiple computers or just one? I just started looking at this but it seems like there is a bit of setup needed for each computer. I guess it might be worth it but would be interested to hear about others experiences.
- danjoc 10y agoYeah, it does require some setup on the ssh client machine. So far, I only set up my home laptop with it. It's probably not hard on the work machine, but different OS so I haven't tried.
- cdsboy 10y agoIt's very easy to setup on linux, but does require a fair bit of setup to get it to work with windows. I haven't set it up on OS X but I expect it to be about as easy as linux. I've been SSH w/ yubikey key only for about 6 months now and haven't had any issues with it. I regularly move between multiple computers. Once I set it up on one computer I've never had it take more than 15 minutes to get up and running on any computer I've need it on (window or linux). The only thing I'm really missing is the ability to log into my server from my phone. There was some talk of getting ConnectBot and Open-Keychain talking to each other to get this working but it appears to be stalled.
- buddylw 10y agoI don't think that the people complaining about the price of this key appreciate all that it can do. Most of those people would probably be better off with the cheaper FIDO U2F Security Key. I haven't found anything else that manages RSA Keys, TOTP auth and U2F in a single package. I'm going to buy this because it plugs into my pixel phone and it seems like it'd be more secure and convenient than my current Neo with NFC.
- tptacek 10y agoAnnoying nerd pedantry: It's only sort of doing TOTP (Yubikeys don't have batteries, so need a software client to provide the clock), and on a slack with almost 300 crypto nerds in it, I don't know any of them that use the Y4 for TOTP (I'm preparing myself to be surprised in a minute when someone there reads this). TOTP is something you do on your phone.
- moreentropy 10y agoTOTP with Yubikeys is great. You just need the Yubico Authenticator app to access the TOTPs. Works fine on phone using NFC as well as on my (Linux) desktop using USB. New phone? Install YK Authenticator, tap the YK and use your TOTPs.
- nickik 10y agoHow do you do TOTP on linux with your Yubikey? I keep using my phone.
- moreentropy 10y agoYubico Authenticator for Desktop: https://www.yubico.com/support/knowledge-base/categories/articles/yubico-authenticator-download/ https://www.yubico.com/support/knowledge-base/categories/art... If you're on Ubuntu you can use the package yubioath-desktop from this PPA: https://launchpad.net/~yubico/+archive/ubuntu/stable https://launchpad.net/~yubico/+archive/ubuntu/stable
- 10y ago
- tptacek 10y agoNote that this isn't just a U2F key; if you're looking for a token principally to log into web services with, this isn't what you want, and the token that does that costs less than half as much (it's the U2F-only token). You want a Y4 if: * You SSH into sensitive machines. * You log into a VPN that you control and can configure to use the Y4. * You're actually relying on PGP.
- bb88 10y agoBitcoin wallet security. That's the next big thing.
- mackncheesiest 10y agoBut it's identical functionality to a Yubikey 4, just with type-C connector, and the product page as well as myself personally can verify that Yubikey 4 supports U2F
- tptacek 10y agoI'm not saying the 4C doesn't do U2F. It's the same as the 4. I'm saying that if all you want to do is log into web services, you probably don't want the Y4.
- sedatk 10y agomore features can even be harmful as in default OTP mode of those devices: https://hackernoon.com/avoid-leaking-your-identity-with-yubikey-92539b6608a#.2yfpwinya https://hackernoon.com/avoid-leaking-your-identity-with-yubi...
- bergie 10y agoGreat to have a USB-C option available, though bummer they didn't include NFC in this one
- Sir_Cmpwn 10y agoRemember that closed source security-related products are a complete joke and you should spend your money somewhere else.
- Filligree 10y agoAny suggestions?
- Sir_Cmpwn 10y agoJust use a TOTP app, at the moment. Note that because there are no U2F alternatives means that you shouldn't use U2F - not that you should settle for an insecure device.
- lorenzhs 10y agoThere are U2F alternatives, several of which are mentioned in this thread. Also, U2F is immune to phishing while TOTP isn't. Your advice is actively harmful.
- Sir_Cmpwn 10y agoI believe I'm speaking to an audience that is generally pretty good at not being phished.
- akerl_ 10y agoThe available data suggests there are no groups of people who are good at not being phished. The audience here is unlikely to send a check to the Nigerian prince looking to smuggle his money to America, but if you're arguing that we shouldn't trust yubikeys against APT backdoors, we're talking about a much higher quality of phishing. I'll take my odds with yubikeys firmware rather than try to vet every site I enter a TOTP code into
- Sir_Cmpwn 10y ago
- chrisacky 10y agoI bought a HyperFido but it just doesn't work on Ubuntu... Was expecting to be able to use it to log in to Google using their 2FA key.. but only works on Windows from what I can see... Anyone know anything about this?
- nhf 10y agoGoogle supports the U2F standard for logins through Chrome. It's a theoretically standardized browser API, but it's only been implemented in Chrome so far.
- lorenzhs 10y agoYou're probably missing some library or other. I know I had to install something in debian unstable, but I don't remember what it was. U2F definitely works on Linux, though.
- nickik 10y agoProbably a udev problem, you need: https://developers.yubico.com/libu2f-host/ https://developers.yubico.com/libu2f-host/ or maybe even better: https://github.com/amluto/u2f-hidraw-policy https://github.com/amluto/u2f-hidraw-policy On the Yubikey its also possible to deactivate individual modes. If somehow U2F mode was disabled, it should not work anywhere, but if you don't use the other modes, maybe deactivate them. In earlier version there were some problems. Probably its the first one.
- esseti 10y agoI've a yubikey4 but i'm not sure how/why i should use it. I get the 2FA case, where it provides the One Time Password to login in some services, sort of what the phone does with the authy app (or am I wrong?). But, what about the ssh access? Should the key be used to decrypt the ssh key when accessing a server? so that, if i grab anycomputer i can login on my server if I've the yubikey with me? if so, how should this work and how can I set it up?
- nhf 10y agoYou can use it as 2FA for your SSH installation too[1]. [1] https://www.yubico.com/why-yubico/for-businesses/computer-login/linux/ https://www.yubico.com/why-yubico/for-businesses/computer-lo...
- pfg 10y agoYou can actually store the key you use for SSH authentication on the Yubikey [1]. The main advantage is that the key never leaves the device, so even if your computer is compromised, your key is still safe. Same thing goes for anything else involving GPG keys - email, signing git commits or tags, software releases, etc. I don't personally use it for OTP. I do use it for services that support U2F (which is different from OTP, and has the main advantage of being immune to phishing). [1]: https://developers.yubico.com/PGP/SSH_authentication/ https://developers.yubico.com/PGP/SSH_authentication/
- esseti 10y agoi'll give it a look. the potetntial of this device is still not clear to me.
- nickik 10y agoI use it for lots of stuff. Lets go threw it. Yubikey supports a number of different 2FA workflows. It supports TOTP (together with a phone), HOTP, Yubico OTP (that is there own standard based on HOTP) and of course most importantly U2F. U2F the new and improved 2FA standard that gives you interesting things like phishing protection. It can also be used to issue a static password, and it can also be used in a ChallangeResponse mode (you send something it and it will get hashed). Both of these can be used to do decryption while booting for example. Now lets get to the more advanced stuff. Yubikey is both a GPG Smartcard and a PIV Smartcard. Essentially this allows you plug in your Yubikey and then automatically your GPG and SSH keys will appear as if they are on the system. If your program, for example Thunderbird or SSH, tries to use the private key, it will require a PIN. This allows you to have no key material on your computer. If you are hacked the attacker has no access to your private keys (and hopefully thanks to 2Fa not to many of your accounts). Even if you lose the keys themselfs your keys will probably not leak. Depending on your situation and security needs you will want this stick either always plugged in your machine, or you want to carry a stick around on your keychain. As for how to set it up, Yubico has lots of documentation. https://developers.yubico.com/ https://developers.yubico.com/ If you have questions, you have my keybase :)
- IgorPartola 10y agoUntil these things work well with phones, I can't buy into them. I have a U2F key that I use as a shortcut for accessing things like Google's services. But I am sticking to always using either Google Authenticator or SMS, if it's available, as a primary option. When I am looking at a website in bed on my phone, and my YubiKey is in my laptop downstairs, I can't say I am happy that I can't access my account. I think the form factor for these things is just wrong. I don't always have my keys with me. I do have my phone much more frequently. Even more frequently I have things like my Pebble. Maybe some kind of NFC interface with a wrist watch would be a better alternative.
- herpderperator 10y agoI use the Yubikey Neo with my phone via NFC to unlock my master password database which I use KeePass for. I wear my Yubikey on my necklace, tucked under my shirt and never remove it (it's waterproof, I shower with it.) I type my master password and just tap my phone to my chest to unlock.
- bergie 10y agoThey have a NFC yubikey available, and most new phones work with USB-C (which this one has)
- dgacmu 10y agoI can confirm that the NFC support works (yubikey neo with a nexus 5x) - but very few applications and sites support it.
- unicornporn 10y agoDo you know if it will work with a 5X running Copperhead OS (no gapps)? Ie. is the apk available?
- dschep 10y agoIt's on F-Droid, so probably: https://f-droid.org/repository/browse/?fdfilter=yubico&fdid=com.yubico.yubioath https://f-droid.org/repository/browse/?fdfilter=yubico&fdid=...
- crusso 10y agoI was just looking around yesterday for a programmatic way to encrypt/decrypt a file with a USB fob. I used an Aladdin fob a while back for a similar project. The encryption was symmetric but the fob kept the key and it couldn't be exported - so it was safe enough for my application. Is this Yubikey capable of something similar?
- wyager 10y agoYou could do OpenPGP encryption. It will generate a symmetric key, encrypt the data with it, and then encrypt the symmetric key for the yubikey's pubkey.
- escapologybb 10y agoI REALLY wish it were possible to use one of these devices without using your hands. I'm quadriplegic and would love to use one of these to unlock my computer, bank passwords etc etc. But you have to touch a finger to almost all of them to trigger the OTP, or whichever authentication and they happen to be using. I would absolutely love to be able to lock and unlock my Mac without an able-bodied person helping me, because really what is the point of me having a password if I tell it to a third party?! Obviously the vast majority of people who use these devices are able-bodied and are able to use them as designed, but if somebody solves this problem there really is a market for it. They are great products, and if it weren't for this one stumbling block I would definitely be using them in my daily life. The inside of my laptop is the only privacy I have, and being able to have complete control over the locking and unlocking of it would be amazing. It would be great if Apple made it possible to use the accessibility software on the login screen, that way I could tap in my own password but you can't use the accessibility software until you are inside the OS. Grrr. Anybody got any ideas about how I could solve this, or any direction I could investigate? (Sorry for mildly hijacking the thread, but thought it was somewhat relevant)
- lytedev 10y agoWhy not run an operating system that does let you use accessibility software at the login screen?
- cbhl 10y agoDoes Windows 10 let you use accessibility software on the login screen?
- escapologybb 10y agoNope. And in my not so humble opinion and speaking from long and frustrating experience, using Windows accessibility software blows really really hard. Really. Hard.
- lstamour 10y ago
- mrmondo 10y agoI wish you could use these with macOS's CoreStorage to unlock FileVault 2's full disk encryption in combination with a password. I wonder if it'll be possible at any point...
- MikeKusold 10y agoI've done OSX authentication (mainly adding 2FA to the login screen), and Apple doesn't provide any mechanism to interact with unlocking FileVault. However, with the Yubikey you can type in your password, then have the Yubikey enter your static password. That way you sort of get 2FA for the unlock screen.
- avenoir 10y agoSo I got one 4 months ago and quickly found out that I understand next to nothing about it. I really thought it was going to be a plug-n-play solution but it was far from it. It took me nearly an hour to get my google account setup to use it. For some reason the little wizard thing on Google that "syncs" your yubikey was giving me trouble. After I finally got that part working i pretty much forgot about the whole thing. I had plans to also use it with KeePass in addition to Google but after reading that you basically have to hack this thing to work with both I pretty much decided it wasn't worth the effort. It's really sad how great this little thing is and how much of a pain it is to actually get any use out of it.
- ruimarinho 10y agoHere's my hands-on review with the new YubiKey 4C: https://news.ycombinator.com/item?id=13637771 https://news.ycombinator.com/item?id=13637771
- philip1209 10y agoThey appear to be sold out already.
- deleted 10y ago[deleted]
- dbrian82 10y agohi,i'm Brian i had my friend help me hack my ex's email, facebook, whatsapp,and his phone cause i suspected he was cheating. all he asked for was a his phone number. he's email is (hotcyberlord425@gmail.com)..IF u need help tell him Brian referred you to him and he'll help. Am sure his going to help you do it, good luck