3 ms·
Yubico's OTP requires you to register your secret on their server and adds a mandatory third party to the authentication process, so it's literally the second w
by anilakar 7y ago
Yubico's OTP requires you to register your secret on their server and adds a mandatory third party to the authentication process, so it's literally the second worst authentication method a Yubikey supports right after a static password.
- akerl_ 7y agoYubico’s OTP protocol requires that. But Yubikeys also support storing TOTP and HOTP secrets, which do not add any 3rd party to the process. Also, to say that using Yubico OTP is “the second worst method” is potentially true, but in a relatively uninteresting way: adding Yubico-OTP-based MFA is so much better than just using a static password that the gap between 1st and 2nd place is huge. The comparative benefit between Yubico OTP and TOTP is tiny by comparison. It’s also worth noting that Yubico has released the spec for validating their OTPs, so it’s possible to do so without a 3rd party: https://www.yubico.com/products/services-software/open-source-servers/ https://www.yubico.com/products/services-software/open-sourc...