3 ms·

> Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? It only uses the key

> Complete noob, stupid question re keyloggers: when YubiKey inserts its token doesn't it go through the same mechanism as keyboard entry? It only uses the keyboard in the OTP mode[1] (which you don't have to use, and you can even configure to completely disable). I guess OTP mode is probably the one you were thinking of ? To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) I'm not familiar with the technicalities of OTP mode but I'm guessing its resilient to replay attacks, so key loggers could still be limited that way. For all other modes (PIV, FIDO, PGP) it doesn't. I believe there is an option to store a static string in the Yubikey and replay that on-demand when you touch it ... but, well, I'd say you're on your own if you choose that option ! [1] https://developers.yubico.com/OTP/OTPs_Explained.html https://developers.yubico.com/OTP/OTPs_Explained.html

quacksilver 4y ago
Anecdotal, though about half of services that I have used only support Yubikeys with OTP mode. PingID does and I think Lastpass does too. I don't use either of them through choice though...
estebank 4y ago
> To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) I've seen it used in terminal applications.
philsnow 4y ago
> To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) A company I worked at years ago used Pritunl as its VPN (which uses OpenVPN under the hood), with Yubico OTP configured. It was a good-enough UX, and the user enrollment procedure downloads a certificate for connecting to OpenVPN which only works for one user, so when people inevitably spammed their Yubico OTPs into Slack, you couldn't use those to log in to the VPN as them since you wouldn't have their certificate. A keylogger would probably be able to access the certificate. To get around that you'd need to do something completely out of band like acknowledge a push notification on an authenticator app on the user's phone.

quacksilver 4y ago

Anecdotal, though about half of services that I have used only support Yubikeys with OTP mode. PingID does and I think Lastpass does too. I don't use either of them through choice though...

estebank 4y ago

> To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) I've seen it used in terminal applications.

philsnow 4y ago

> To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :) A company I worked at years ago used Pritunl as its VPN (which uses OpenVPN under the hood), with Yubico OTP configured. It was a good-enough UX, and the user enrollment procedure downloads a certificate for connecting to OpenVPN which only works for one user, so when people inevitably spammed their Yubico OTPs into Slack, you couldn't use those to log in to the VPN as them since you wouldn't have their certificate. A keylogger would probably be able to access the certificate. To get around that you'd need to do something completely out of band like acknowledge a push notification on an authenticator app on the user's phone.