3 ms·
yea a coworker uses YubiKey... it generates extremely strong one-time-use passwords (essentially just meaning it auto-generates a different one for every site?)
by fat0wl 12y ago
yea a coworker uses YubiKey... it generates extremely strong one-time-use passwords (essentially just meaning it auto-generates a different one for every site?) & auto-enters them through a browser add-on when the device is in USB (I believe?)
seems like solutions like that are a bit easier than typing in a bunch of keys you are looking up on a card and really solve the issue of web-based attacks.... it really only leaves you vulnerable to people who have physical access to the USB device, and even then i can imagine simple ways to make even that a hassle (have another password layer as master sign-in? would be enough to deter most of your acquaintances from being able to use your device)
- danieldk 12y agoA normal Yubikey is still vulnerable to MITM and phishing attacks. The combination of a password (using a password manager) and a U2F key is more secure (Yubico also has U2F keys). U2F keys avoid phishing and most MITM attacks by generating a unique keypair per origin. Since a phishing site or MITM does not have the same origin, they cannot successfully complete a challenge-response with the key. Also, AFAIR, Yubikey OTP requires the use of a Yubikey server which knows the shared secret, which may be problematic.
- Nullabillity 12y agoYou can replace the Yubikey's OTP seed with your own to bypass their server. https://www.yubico.com/applications/internet-services/gmail/ https://www.yubico.com/applications/internet-services/gmail/
- danieldk 12y agoYes, but then it won't be supported by many sites that support Yubikey OTP and rely on Yubico's servers for authentication.