Re:A plastic card for easy to remember strong passwords
by danieldk on Sunday January 11, 2015 @11:32AM
(#8870347)
A normal Yubikey is still vulnerable to MITM and phishing attacks.
The combination of a password (using a password manager) and a U2F key is more secure (Yubico also has U2F keys). U2F keys avoid phishing and most MITM attacks by generating a unique keypair per origin. Since a phishing site or MITM does not have the same origin, they cannot successfully complete a challenge-response with the key.
Also, AFAIR, Yubikey OTP requires the use of a Yubikey server which knows the shared secret, which may be problematic.
Re:A plastic card for easy to remember strong passwords
by Nullabillity on Sunday January 11, 2015 @12:39PM
(#8870534)
You can replace the Yubikey's OTP seed with your own to bypass their server. https://www.yubico.com/applications/internet-services/gmail/
seems like solutions like that are a bit easier than typing in a bunch of keys you are looking up on a card and really solve the issue of web-based attacks.... it really only leaves you vulnerable to people who have physical access to the USB device, and even then i can imagine simple ways to make even that a hassle (have another password layer as master sign-in? would be enough to deter most of your acquaintances from being able to use your device)