5 ms·

Yeah, YubiKeys are great. I have been using mine for about a year now and I also use a YubiKey PAM module to log in into my Ubuntu workstation. If you search

Yeah, YubiKeys are great. I have been using mine for about a year now and I also use a YubiKey PAM module to log in into my Ubuntu workstation. If you search google a bit I am pretty sure you will find a discount code to get it even cheaper :)

MattJ100 16y ago
I got mine for free from a user of my software who wanted me to add support :) In fact I finished that just this week, I'm considering using it full-time for some of my machines now. The nice thing as far as I'm concerned is that unlike some other similar devices, all the specs for the OTP generation and all the software components are open-source.
tomkinstinch 16y ago
The price point was right for me; I just ordered one. They mention a coupon on their site for the "VIP" token: http://www.yubico.com/january-2011-newsletter http://www.yubico.com/january-2011-newsletter It looks like the VIP version is exactly the same as the regular, but it comes with a Symantec identity that can be removed. Now to get two-factor auth working on my boxes... It seems there is a Python PAM module: https://github.com/Kami/advanced-yubico-pam-module https://github.com/Kami/advanced-yubico-pam-module
agotterer 16y ago
What if you lose your YubiKey?
- wmf 16y ago
  You need to have a recovery process similar to if you lose your phone.
crocowhile 16y ago
You can actually achieve the same with any USB thumbdrive: http://pamusb.org/ http://pamusb.org/
- wmf 16y ago
  If someone "borrows" your thumb drive they could extract the secrets and return it without you knowing, but AFAIK secrets cannot be extracted from a real token such as a Yubikey.
  - crocowhile 16y ago
    It doesn't just work by reading a passkey. From the webpage: * Non-intrusive. pam_usb doesn’t require any modifications of the USB storage device to work (no additional partitions required). * USB Serial number, model and vendor verification.
    - wmf 16y ago
      So is it only for local console authentication? There's no way to read that stuff remotely.
      - crocowhile 16y ago
        Come on mate, just use a bit of imagination. You use the pam_usb module to login locally and an encrypted passkey stored on the same usb thumbdrive for remote SSH connections.

MattJ100 16y ago

I got mine for free from a user of my software who wanted me to add support :) In fact I finished that just this week, I'm considering using it full-time for some of my machines now. The nice thing as far as I'm concerned is that unlike some other similar devices, all the specs for the OTP generation and all the software components are open-source.

tomkinstinch 16y ago

The price point was right for me; I just ordered one. They mention a coupon on their site for the "VIP" token: http://www.yubico.com/january-2011-newsletter http://www.yubico.com/january-2011-newsletter It looks like the VIP version is exactly the same as the regular, but it comes with a Symantec identity that can be removed. Now to get two-factor auth working on my boxes... It seems there is a Python PAM module: https://github.com/Kami/advanced-yubico-pam-module https://github.com/Kami/advanced-yubico-pam-module

agotterer 16y ago

What if you lose your YubiKey?

wmf 16y ago
You need to have a recovery process similar to if you lose your phone.

crocowhile 16y ago

You can actually achieve the same with any USB thumbdrive: http://pamusb.org/ http://pamusb.org/

wmf 16y ago
If someone "borrows" your thumb drive they could extract the secrets and return it without you knowing, but AFAIK secrets cannot be extracted from a real token such as a Yubikey.
- crocowhile 16y ago
  It doesn't just work by reading a passkey. From the webpage: * Non-intrusive. pam_usb doesn’t require any modifications of the USB storage device to work (no additional partitions required). * USB Serial number, model and vendor verification.
  - wmf 16y ago
    So is it only for local console authentication? There's no way to read that stuff remotely.
    - crocowhile 16y ago
      Come on mate, just use a bit of imagination. You use the pam_usb module to login locally and an encrypted passkey stored on the same usb thumbdrive for remote SSH connections.