No word on switching back to open source. Their YubiKey NEO was open source; not sure why insist on proprietary code for the YubiKey 4. I'm frankly not comfortable with this kind of "security by obscurity".
It's unfortunate that there is no Yubikey nano for USB-C yet. I really like the nano form factor, especially because I can't accidentally break a USB port like I could with the normal sized one.
I guess it's really hard to fit all of the electronics in a port as small as USB-C though.
Are there USB-C to, uh, "normal" USB adapters out? You know, that go the OTHER way?
I'd hate to not be able to use the USB-C Yubikey with my desktop, my keyboard port, my hubs, etc. Seems easier to just use the normal Yubikey plus a dongle for the few machines that support USB-C.
I like the form factor, but as a second factor it sucks. Effectively your computer becomes the second factor, and it's much more likely that your laptop (with the Nano plugged in it) is stolen, than a keychain with a bigger Neo.
It's acceptable if you only use it for OTP, but I can't get myself to put GPG private keys on a Yubikey Nano...
A security token is an excellent concept, but usually fails when applied to 'typical' use-case scenarios.
Are you military personnel who is in charge of turning the key and launching the nukes? -Excellent reason to have a key that is impossible to forge.
-Also, "key discipline" is likely very high.
Are you a paranoid nerd that wants to make sure that you cannot be compromised?
-Excellent reason to have a key that is impossible to forge.
-But what happens when you lose that security token?
i.e. "Honey! I can't find the car keys, have you seen them?"
We desperately need _BETTER_ 2FA. Bio-metrics are not the answer. I would be in favor of an implantable RFID chip or whatever 'better' tech comes around.
> But what happens when you lose that security token?
Pretty simple: you use your backup key to revoke the lost key. This is possible with e.g. Lastpass and Google. Of course, if the attacker logs in before you revoke the key, you are hosed, but the same would be true in your car analogy.
> i.e. "Honey! I can't find the car keys, have you seen them?"
With car keys, too, you have a backup key. Arguably, the physical car keys are easier to copy.
> I would be in favor of an implantable RFID chip or whatever 'better' tech comes around.
Nothing new, see this article from 2004 [1]. As you can read in the article, its first headline was even in 2001 (to put in perspective this is 15 to 16 years ago). Company's name is VeriChip.
The problem is that the signal can be intercepted (AFAIK it doesn't use a form of OTP), and the key cannot be easily replaced/revoked. A YubiKey doesn't suffer from this issue. The issue a YubiKey has is that it can be easier lost than an implant.
The YubiKey Neo ('large' version, not the 'laptop' version) supports NFC.
Not disagreeing with your comment, but what do biometrics have to do with this article? I don't think Yubico does anything with biometrics, and these devices definitely don't have any such capability.
Moreover, U2F already is awesome 2FA (better than _BETTER_). Fast and unphishable. Buy a few of these, keep one on your keychain, one on your desk at home, and a backup locked in your safe, and you're all set.
We use the USB-A version of these things extensively at my company, and they're unbelievably convenient.
We don't need better 2FA, we need better 1FA. Biometrics are not the answer for that either, but rather new protocols that are independend of the mechanism you use.
That exactly what the FIDO protocols are trying to do.
You can use you shitty local fingerprint sensor as a authenticator but you will still get better security agains everything exept if somebody steals your phone.
Phising is the biggest problem, it needs to be solved. We can do it in the first or the second factor. People either need to move to U2F or they need to move UAF on the first factor.
Practically speaking, I've been using a yubikey plugged permanently into my laptop for many years, and it works fine. I use it to authenticate to my work VPN (with a password as second factor).
The only downsides are: one fewer USB port, and the green light on the yubikey which is permanently lit.
Indeed it is always important when considering security, to look at the other side and balance the risk of someone else gaining unauthorised access with you possibly losing access forever. Everyone wants "unbreakable" encryption, but unfortunately it seems very few consider the possibility of themselves losing the key --- perhaps it is because locks in the physical world are not quite as strong as good data encryption, and can be easily overcome with locksmiths and the like.
> But what happens when you lose that security token?
It's really not that big of a problem, at least in the "paranoid nerd" context. Just have backup keys that your users can print out and keep in a safe place. Or have more than one U2F device - most implementations I'm aware of allow users to register more than one device.
Of course, for most applications, there'd still be the usual support backdoor. That's definitely a problem not quite as easy to solve.
Moi? I'd rather buy ten passive backup keys than implant an RFID key that puts out a signal that never turns off. At that point you're robbing Peter of pay...Well...Um...Big Brother.
Maybe I'm going about this the wrong way but how do people handle 2FA across multiple machines with multiple keys?
I have multiple desktops, laptop and several mobile devices that I often context switch across. I'd like to use 2FA without having to plug and unplug the key every time I want to switch devices.
What I really want is not USB-C but rather a Yubikey 4 the supports NFC. None of the sticks support all features, is quite vexing. Now I have to carry different sticks for different reasons.
"Your YubiKey provides a second factor of security for your logins, beyond a username and password. Your YubiKey needs to be registered or paired with each computer, service, or site you use it with. "
Yeah, it's basically a smart card you can use with a bunch of popular sites like Google, GitHub, Dropbox, etc. (See http://www.dongleauth.info/ for a more extensive list.) Based on an open standard (FIDO U2F). Some versions also support storing PGP keys and the like.
I invite to take a look at the just released Yubikey Handbook (https://github.com/ruimarinho/yubikey-handbook), an open source book on the many different Yubikey use cases and stories.
It has two modes. If you short press it, it will generate a one time password. A long press will output a static password. Both modes can be configured optionally.
A yubikey 4 or Neo has 2 slots which can be configured for about 5 different things. OTP, challenge response, static password, and some other things I can't remember right now. It also has 3 slots for a PGP private key, signing key, and encryption key. It also has 4 PIV slots to use as smart card key storage for authentication (ssh), code signing, and other things I can't remember. Then there are additional PIV slots to hold expired keys you might want to keep around for some reason?
It has quite a lot of functionality for a little device. The main difference between Neo and 4 is Neo has NFC, where 4 supports 4096 pgp keys. 4 is the newer one, but nothing new has NFC yet.
I use it with luks for full disk encryption, ssh, and to store my pgp key for QTPass/Android Password Store. QTPass + passff extension for firefox is nice.
I haven't set it up as a 2FA for sudo yet, but that's possible also. I don't plan to use it for PGP encrypted email for the same reasons described here.
It's unfortunate that they went closed source but I still have a Neo here that survived several months in my washing machine (it got silently caught between the rubber manifold and the drum).
Eventually when I found it again, plugged it in expecting nothing, but was greeted with the green flashing led and the button worked just fine. I still have it but don't use it anymore, the closed source thing grates a little with me so use other methods now.
Have you tried to setup a Yubikey with RSA-keys and click-to-sign? It's things you expect "just to work", but the tooling around the Yubikey sucks big time and thats what holding them back. It's a shame though cause they make really good hardware.
Their strategy has been to gain tracktion through the major tech players. Think it's time for Stina to realize they cannot ignore the rest of us if they want to make it big.
Great! The reason I bought a Yubikey Neo over the Yubikey 4 is that I need access to the key on all my devices - computers and my phone(s). It's a way to do secure and user-friendly way to solve the key distribution problem to have access to your TOTP tokens, FIDO credentials and/or your PGP keys on all your stuff. I would not use PGP otherwise, as it leaves key distribution as an exercise to the user [2].
Since USB-C is going to be the standard on computers, phones and tablets this new product will be very versatile and usable secure authentication across almost all devices [1]. Only question is - do apps like Yubico Authenticator and OpenKeyChain support this on Android already?
[1]: You're out of luck on iDevices of course, but you're out of luck with iDevices and Yubikey already.
[2]: This was much less of a problem for the first ~15 years of PGP's existence of course, but it feels old-fashioned nowadays.
I'd love to replace my YubiKey Neo with the USB-C version because it looks more rugged. That said my Neo works fine but I fear it destroying a USB port after a minor accident.
However, my problem with USB-C is while it works great on my laptop, my desktop doesn't have a USB-C port anywhere near my desk or keyboard. I'd have to buy a hub or something. I'm sure this will get better as I find excuses to replace parts of my desktop hardware.
What are the options for handling loss or theft of your YubiKey if using as an individual? I love the concept of a physical token as a second auth factor, but last I checked, there were no good loss-recovery scenarios when used as an individual (versus in a corporate environment where IT manages the Yubikeys).
Does anyone know why the yubikey 4 supports RSA 4096, but ECC only goes up to 384 and not 521? Sure 384 is likely "enough" but ECC 521 is both faster and smaller than RSA4096. I just can't seem to figure out why they would impose that limit.
Anyone else using a similar product, OTHER than Yubikey? I've read on certain forums about Yubikeys being "flimsy" and less durable than similar products; is this true? what is your experience with it?
I have a less durable, cheaper U2F key, which is sort of the opposite of what you were asking for. I actually don't know of anything that's more durable... the yubikeys that fit inside a USB A port are pretty damn durable.
I have four Yubikeys (three of the "4" variant, one of the nano) and all of them are extremely durable. You'd have to purposefully try to damage one for anything to happen to it.
Yubikeys actually seem pretty durable; that seems to be the gist of the opinions I've read on their durability. A piece of anecdotal evidence; I am carrying an older model Yubikey on my keyring, and it is holding up pretty well (almost two years now).
I have had a yubikey neo on my keychain for almost 4 years now. It is thin plastic and seemed like it might not hold up this long, but it has been going strong. I think they have changed designs to make it smaller since (which would be stronger). They do make solid products.
That said, I would rather use Google Authenticate (TOTP) for two factor. Getting my phone out is a regular thing. Getting the yubikey out and plugging it in seems more of a hassle. Passpack is the only thing I have to use the yubikey for -- would be happy if they provided TOTP. Spending $40 for two factor these days is kind of ridiculous.
I have a Nitrokey Pro in addition to my YubiKey 4. I love that it's got a much more open design and am happy to support the company for that reason, but its enclosure looks like a reasonably good generic USB key. Going only by tactile feel, I expect the Yubikey to outlast it.
I've had a YubiKey on my keychain for over a year and a half and it's held up very well. It looks quite beat up due to being in my pocket, rubbing on other keys, and so on but it works perfectly.
I have a regular Yubikey 4 - it looks like flimsy plastic but it's surprisingly strong. I can't snap it in half even with full force, doesn't even seem to bend.
Couldn't there be a passthrough? I guess that means making the key a two port hub (one internal for the key itself, one external for connection additional devices).
[+] [-] blintz|9 years ago|reply
https://github.com/Yubico/ykneo-openpgp/issues/2#issuecommen...
Edit: Never mind, there's actually a reasonable explanation for the change: https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...
[+] [-] Tharre|9 years ago|reply
I guess it's really hard to fit all of the electronics in a port as small as USB-C though.
[+] [-] rconti|9 years ago|reply
I'd hate to not be able to use the USB-C Yubikey with my desktop, my keyboard port, my hubs, etc. Seems easier to just use the normal Yubikey plus a dongle for the few machines that support USB-C.
[+] [-] Corrado|9 years ago|reply
[+] [-] bonzini|9 years ago|reply
It's acceptable if you only use it for OTP, but I can't get myself to put GPG private keys on a Yubikey Nano...
[+] [-] VA3FXP|9 years ago|reply
Are you military personnel who is in charge of turning the key and launching the nukes? -Excellent reason to have a key that is impossible to forge. -Also, "key discipline" is likely very high.
Are you a paranoid nerd that wants to make sure that you cannot be compromised? -Excellent reason to have a key that is impossible to forge. -But what happens when you lose that security token?
i.e. "Honey! I can't find the car keys, have you seen them?"
We desperately need _BETTER_ 2FA. Bio-metrics are not the answer. I would be in favor of an implantable RFID chip or whatever 'better' tech comes around.
[+] [-] Fnoord|9 years ago|reply
Pretty simple: you use your backup key to revoke the lost key. This is possible with e.g. Lastpass and Google. Of course, if the attacker logs in before you revoke the key, you are hosed, but the same would be true in your car analogy.
> i.e. "Honey! I can't find the car keys, have you seen them?"
With car keys, too, you have a backup key. Arguably, the physical car keys are easier to copy.
> I would be in favor of an implantable RFID chip or whatever 'better' tech comes around.
Nothing new, see this article from 2004 [1]. As you can read in the article, its first headline was even in 2001 (to put in perspective this is 15 to 16 years ago). Company's name is VeriChip.
The problem is that the signal can be intercepted (AFAIK it doesn't use a form of OTP), and the key cannot be easily replaced/revoked. A YubiKey doesn't suffer from this issue. The issue a YubiKey has is that it can be easier lost than an implant.
The YubiKey Neo ('large' version, not the 'laptop' version) supports NFC.
> We desperately need _BETTER_ 2FA.
Why? How?
[1] http://www.wnd.com/2004/04/24179/
[+] [-] sowbug|9 years ago|reply
Moreover, U2F already is awesome 2FA (better than _BETTER_). Fast and unphishable. Buy a few of these, keep one on your keychain, one on your desk at home, and a backup locked in your safe, and you're all set.
We use the USB-A version of these things extensively at my company, and they're unbelievably convenient.
[+] [-] nickik|9 years ago|reply
That exactly what the FIDO protocols are trying to do.
You can use you shitty local fingerprint sensor as a authenticator but you will still get better security agains everything exept if somebody steals your phone.
Phising is the biggest problem, it needs to be solved. We can do it in the first or the second factor. People either need to move to U2F or they need to move UAF on the first factor.
This is really the only hope.
[+] [-] rwmj|9 years ago|reply
The only downsides are: one fewer USB port, and the green light on the yubikey which is permanently lit.
[+] [-] userbinator|9 years ago|reply
[+] [-] pfg|9 years ago|reply
It's really not that big of a problem, at least in the "paranoid nerd" context. Just have backup keys that your users can print out and keep in a safe place. Or have more than one U2F device - most implementations I'm aware of allow users to register more than one device.
Of course, for most applications, there'd still be the usual support backdoor. That's definitely a problem not quite as easy to solve.
[+] [-] daurnimator|9 years ago|reply
Like a vivokey? http://vivokey.com/learn-more.html
[+] [-] chiefalchemist|9 years ago|reply
[+] [-] newman314|9 years ago|reply
I have multiple desktops, laptop and several mobile devices that I often context switch across. I'd like to use 2FA without having to plug and unplug the key every time I want to switch devices.
[+] [-] nickik|9 years ago|reply
[+] [-] jacko0|9 years ago|reply
[+] [-] CoolGuySteve|9 years ago|reply
"Your YubiKey provides a second factor of security for your logins, beyond a username and password. Your YubiKey needs to be registered or paired with each computer, service, or site you use it with. "
[+] [-] Ajedi32|9 years ago|reply
[+] [-] ruimarinho|9 years ago|reply
Everyone of us has asked that question before :)
Open to contributions as well!
[+] [-] colept|9 years ago|reply
[+] [-] danjoc|9 years ago|reply
A yubikey 4 or Neo has 2 slots which can be configured for about 5 different things. OTP, challenge response, static password, and some other things I can't remember right now. It also has 3 slots for a PGP private key, signing key, and encryption key. It also has 4 PIV slots to use as smart card key storage for authentication (ssh), code signing, and other things I can't remember. Then there are additional PIV slots to hold expired keys you might want to keep around for some reason?
It has quite a lot of functionality for a little device. The main difference between Neo and 4 is Neo has NFC, where 4 supports 4096 pgp keys. 4 is the newer one, but nothing new has NFC yet.
I use it with luks for full disk encryption, ssh, and to store my pgp key for QTPass/Android Password Store. QTPass + passff extension for firefox is nice.
I haven't set it up as a 2FA for sudo yet, but that's possible also. I don't plan to use it for PGP encrypted email for the same reasons described here.
https://blog.filippo.io/giving-up-on-long-term-pgp/
[+] [-] _joel|9 years ago|reply
[+] [-] 2bluesc|9 years ago|reply
Currently my YubiKey Neo only supports RSA 2048 as it's a hardware limitation of the NXP A700x chip used inside.
[0] https://www.yubico.com/2015/02/big-debate-2048-4096-yubicos-...
[+] [-] spchampion2|9 years ago|reply
[+] [-] polack|9 years ago|reply
Their strategy has been to gain tracktion through the major tech players. Think it's time for Stina to realize they cannot ignore the rest of us if they want to make it big.
[+] [-] nickik|9 years ago|reply
But its really all the fault of apple stupid NFC police, not some other issue.
[+] [-] jsjohnst|9 years ago|reply
[+] [-] jlgaddis|9 years ago|reply
[+] [-] DCKing|9 years ago|reply
Since USB-C is going to be the standard on computers, phones and tablets this new product will be very versatile and usable secure authentication across almost all devices [1]. Only question is - do apps like Yubico Authenticator and OpenKeyChain support this on Android already?
[1]: You're out of luck on iDevices of course, but you're out of luck with iDevices and Yubikey already.
[2]: This was much less of a problem for the first ~15 years of PGP's existence of course, but it feels old-fashioned nowadays.
[+] [-] 2bluesc|9 years ago|reply
However, my problem with USB-C is while it works great on my laptop, my desktop doesn't have a USB-C port anywhere near my desk or keyboard. I'd have to buy a hub or something. I'm sure this will get better as I find excuses to replace parts of my desktop hardware.
[+] [-] jsjohnst|9 years ago|reply
I'm surprised folks like the Neo though. I rarely use mine anymore as I kept accidentally triggering it when I carried my laptop to meetings.
[+] [-] jerf|9 years ago|reply
Not a new problem for USB-C, of course.
[+] [-] joshpadnick|9 years ago|reply
[+] [-] lawpoop|9 years ago|reply
The first week I had it, I left it inserted in the computer a number of times. Now I keep it on my keys so that I don't forget to remove it.
Now I
[+] [-] jwatte|9 years ago|reply
(OTG too for various devices, of you want really wide compatibility)
[+] [-] georgyo|9 years ago|reply
[+] [-] supermatou|9 years ago|reply
[+] [-] dmoy|9 years ago|reply
[+] [-] michaelmcdonald|9 years ago|reply
[+] [-] colept|9 years ago|reply
[+] [-] Freak_NL|9 years ago|reply
They certainly don't come across as flimsy.
[+] [-] daveguy|9 years ago|reply
That said, I would rather use Google Authenticate (TOTP) for two factor. Getting my phone out is a regular thing. Getting the yubikey out and plugging it in seems more of a hassle. Passpack is the only thing I have to use the yubikey for -- would be happy if they provided TOTP. Spending $40 for two factor these days is kind of ridiculous.
[+] [-] devicenull|9 years ago|reply
[+] [-] Arubis|9 years ago|reply
[+] [-] NuSkooler|9 years ago|reply
[+] [-] rolodato|9 years ago|reply
[+] [-] cmurf|9 years ago|reply
[+] [-] arielweisberg|9 years ago|reply
[+] [-] joeseeder|9 years ago|reply