News for hackers. Stuff that matters.

A comment on YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support. Parent comment

Re:YubiKey comes to the iPhone with Mobile SDK for iOS and L... by gruez on Tuesday May 22, 2018 @01:10PM (#17127523)
>AFAIK that means it'll take more than a jailbreak to get to them, although I don't know if OTP apps are using that capability or not.

sure, you wouldn't be able to extract the keys, but what's preventing you from generating thousands of codes and extracting those instead? since they're time based, you could easily generate lots of them for a long time into the future (eg. 10 per day for the next 5 years). that should afford you plenty of opportunities to do a login attempt.

[ Parent | on HN ]
Re:YubiKey comes to the iPhone with Mobile SDK for iOS and L... by moduspwnens14 on Tuesday May 22, 2018 @01:18PM (#17127621)
This can't be used directly for generating OTP tokens (see the other comments), but what would stop you with a normal key on the secure enclave is that you can require the enclave itself requires a higher level of authentication (facial scan match, fingerprint scan) to perform those key operations.
[ Parent | on HN ]