4 ms·

I follow this in practice, but I always have to wonder: what if someone gets my password database and breaks it? It would only take a keylogging trojan to get

I follow this in practice, but I always have to wonder: what if someone gets my password database and breaks it? It would only take a keylogging trojan to get everything they needed. I would be in for a world of hurt! Way worse than if a few of my accounts were compromised because I had used the same password. But still, the chances of being compromised are probably much smaller.

DanBC 14y ago
As mentioned by other people in other recent threads some good quality password safe programs work with Yubikey, so an attacker needs something you know (your password) and something you have (your Yubikey). I'd be interested in seeing some robust analysis of password safe software. But "Password safe" and "keepass" appear to be reputable. I'd also like a native, and trustworthy, password safe for OS X that can work with something like Yubikey.
- BadassFractal 14y ago
  Is Yubikey superior to something like Keepass/Lastpass/1password?
  - MiguelHudnandez 14y ago
    Yubikey works just like Google Authenticator, except it is a little more convenient to type in the code. (you touch a physical button on the dongle, and it types the code for you) It does not actually save any passwords. It would replace Google Authenticator or an RSA SecurID FOB.
    - dkokelley 14y ago
      Now this is convent, provided I don't have to access my password safe on a mobile device without a USB port. Does Yubikey have an app or work with Google Authenticator? I know I can use LastPass with Google Authenticator to identify trusted devices. Still not perfect, but perfect security would be too inconvenient for anyone to use.
  - DanBC 14y ago
    Yubikey would be in addition to the password used on Keepass. So you need your password and the Yubikey to unlock your password safe. You could set the Yubikey up to be the password - so you only need the Yubikey to open up Keepass.
vitalique 14y ago
It depends on which service you actually use, but to my knowledge almost all of the worthy ones provide pre-generation of one-time passwords. Just get a bunch of those passwords on the paper in some proper place to fear the keyloggers no more.

DanBC 14y ago

As mentioned by other people in other recent threads some good quality password safe programs work with Yubikey, so an attacker needs something you know (your password) and something you have (your Yubikey). I'd be interested in seeing some robust analysis of password safe software. But "Password safe" and "keepass" appear to be reputable. I'd also like a native, and trustworthy, password safe for OS X that can work with something like Yubikey.

BadassFractal 14y ago
Is Yubikey superior to something like Keepass/Lastpass/1password?
- MiguelHudnandez 14y ago
  Yubikey works just like Google Authenticator, except it is a little more convenient to type in the code. (you touch a physical button on the dongle, and it types the code for you) It does not actually save any passwords. It would replace Google Authenticator or an RSA SecurID FOB.
  - dkokelley 14y ago
    Now this is convent, provided I don't have to access my password safe on a mobile device without a USB port. Does Yubikey have an app or work with Google Authenticator? I know I can use LastPass with Google Authenticator to identify trusted devices. Still not perfect, but perfect security would be too inconvenient for anyone to use.
- DanBC 14y ago
  Yubikey would be in addition to the password used on Keepass. So you need your password and the Yubikey to unlock your password safe. You could set the Yubikey up to be the password - so you only need the Yubikey to open up Keepass.

vitalique 14y ago

It depends on which service you actually use, but to my knowledge almost all of the worthy ones provide pre-generation of one-time passwords. Just get a bunch of those passwords on the paper in some proper place to fear the keyloggers no more.