4 ms·
Correct me if I am wrong, but I think the YubiKeys are PIN based. So in order to use it to authenticate you have to enter a PIN and three wrong attempts result
by jpdb 8y ago
Correct me if I am wrong, but I think the YubiKeys are PIN based. So in order to use it to authenticate you have to enter a PIN and three wrong attempts results in it locking. The PIN itself would be the, "something you know," and the YubiKey is the, "something you have."
- tempay 8y agoThis isn't correct, they only have a single small button.
- chaosite 8y agoThey do have a PIN but you don't enter it every time you authenticate. The PIN is used to configure the YubiKey itself.
- akerl_ 8y agoDepends how you use the yubikeys. They support x509 certs, which use PINs. Whether it needs the PIN once-per-session, once-per-15seconds, or once-per-use is configurable. The number of failures before it locks is also configurable. More details can be found here: https://developers.yubico.com/PIV/Introduction/ https://developers.yubico.com/PIV/Introduction/ They also support TOTP/HOTP, where the computer asks the device for a code based on a secret key that the device knows. This can require a touch of the button. EDIT: TOTP/HOTP modes do support a password, as cimnine pointed out. I'd forgotten about that setting. Yubico OTP is similar to TOTP/HOTP, and is the mode where the yubikey emits a gibberish string when pressed. The string gets validated by the server against Yubico's servers. This does not require a PIN. The U2F mode does challenge/response via integration with Chrome and other apps. The app provides info to the USB device about the site that's requesting auth, then you press the device and it sends a token back. This is critical to the phishing protection: barring any vulns in the local app (which have happened before), you can't create a phishing site that will ask my Yubikey for a challenge that you can then replay against the real site. This mode requires physical touch but no PIN.