3 ms·
Similar concept but the Google proposal is better for a number of reasons (I'm assuming Google's is based of public key cryptography). Yubikeys have to be verif
by asdfaoeu 14y ago
Similar concept but the Google proposal is better for a number of reasons (I'm assuming Google's is based of public key cryptography). Yubikeys have to be verified by yubico so you have to trust them. This also means it can be safely used by any untrustworthy source. It also means anyone could produce these. The Google one isn't vulnerable a phishing site with a valid SSL certificate between you and the target site. Lastly, the yubikey is really implemented as just a hack it just pretends to be a keyboard that types the code when you press the button I think a more specific protocol would be better although understandably the yubico one is more compatible.
- cdjk 14y agoThe yubikey hardware interface is actually pretty clever. Having to press the button means there is physical interaction when using it, which means that if the auth was successful, the user actually did something. It also means that if it's left plugged in and the machine is compromised, the attacker can't use it. It also means you dont have to worry about drivers, and can use it on whatever OS you want (OK, any OS that supports USB keyboards).