Yubico launches its dual USB-C and Lightning two-factor security key

Re:Yubico launches its dual USB-C and Lightning two-factor s... by penagwin on Tuesday August 20, 2019 @12:33PM (#20748864)

I know the client key is derived from the server key (So if Facebook's was released, your Google's TOTP is still safe).

I'm guessing it depends on the implementation, are the server secrets normally derived per user or shared across users (Talking about just a single service such as facebook)?

[ Parent | on HN ]

Re:Yubico launches its dual USB-C and Lightning two-factor s... by tialaramex on Tuesday August 20, 2019 @12:55PM (#20749144)

> I know the client key is derived from the server key

No. TOTP is a shared secret system, there is only one key.

> I'm guessing it depends on the implementation, are the server secrets normally derived per user or shared across users

Again no. The only reasonable thing to do is pick secrets entirely at random for each user. If the same secret is used then users can trivially impersonate each other, which makes no sense.

[ Parent | on HN ]