3 ms·

Isn't this exactly the same concept (if not implementation) as that of the yubikey (http://www.yubico.com/ http://www.yubico.com/) In fact, google supports yubi

by daffers 14y ago

Isn't this exactly the same concept (if not implementation) as that of the yubikey (http://www.yubico.com/ http://www.yubico.com/) In fact, google supports yubikey for google mail login. I use mine with Lastpass password vault. Once you have the browser plugin it makes it so easy login and generate secure passwords.

Inversechi 14y ago
What's using a yubikey like? I've got LastPass premium account and seen it being promoted... How would it work with the password manager on your mobile? Ahh - just seen it's got NFC build in.
- NateDad 14y ago
  You can use google authenticator as a second factor for lastpass, that's what I do. Install the free app, hook it up to your account, bam, hugely more secure. And you can get lastpass to remember certain devices, so you don't have to keep authenticating on your home laptop, for example (and you can always go to the site and revoke access to that machine if it ever gets lost). It's pretty awesome.
asdfaoeu 14y ago
Similar concept but the Google proposal is better for a number of reasons (I'm assuming Google's is based of public key cryptography). Yubikeys have to be verified by yubico so you have to trust them. This also means it can be safely used by any untrustworthy source. It also means anyone could produce these. The Google one isn't vulnerable a phishing site with a valid SSL certificate between you and the target site. Lastly, the yubikey is really implemented as just a hack it just pretends to be a keyboard that types the code when you press the button I think a more specific protocol would be better although understandably the yubico one is more compatible.
- cdjk 14y ago
  The yubikey hardware interface is actually pretty clever. Having to press the button means there is physical interaction when using it, which means that if the auth was successful, the user actually did something. It also means that if it's left plugged in and the machine is compromised, the attacker can't use it. It also means you dont have to worry about drivers, and can use it on whatever OS you want (OK, any OS that supports USB keyboards).
drucken 14y ago
Interestingly, on Yubikey NEO's web page: Currently sold out. We expect new orders to ship in 7 weeks.

by daffers 14y ago

Inversechi 14y ago

What's using a yubikey like? I've got LastPass premium account and seen it being promoted... How would it work with the password manager on your mobile? Ahh - just seen it's got NFC build in.

NateDad 14y ago
You can use google authenticator as a second factor for lastpass, that's what I do. Install the free app, hook it up to your account, bam, hugely more secure. And you can get lastpass to remember certain devices, so you don't have to keep authenticating on your home laptop, for example (and you can always go to the site and revoke access to that machine if it ever gets lost). It's pretty awesome.

asdfaoeu 14y ago

Similar concept but the Google proposal is better for a number of reasons (I'm assuming Google's is based of public key cryptography). Yubikeys have to be verified by yubico so you have to trust them. This also means it can be safely used by any untrustworthy source. It also means anyone could produce these. The Google one isn't vulnerable a phishing site with a valid SSL certificate between you and the target site. Lastly, the yubikey is really implemented as just a hack it just pretends to be a keyboard that types the code when you press the button I think a more specific protocol would be better although understandably the yubico one is more compatible.

cdjk 14y ago
The yubikey hardware interface is actually pretty clever. Having to press the button means there is physical interaction when using it, which means that if the auth was successful, the user actually did something. It also means that if it's left plugged in and the machine is compromised, the attacker can't use it. It also means you dont have to worry about drivers, and can use it on whatever OS you want (OK, any OS that supports USB keyboards).

drucken 14y ago

Interestingly, on Yubikey NEO's web page: Currently sold out. We expect new orders to ship in 7 weeks.