News for hackers. Stuff that matters.

A comment on A plastic card for easy to remember strong passwords. Parent comment

Re:A plastic card for easy to remember strong passwords by danieldk on Sunday January 11, 2015 @11:32AM (#8870347)
A normal Yubikey is still vulnerable to MITM and phishing attacks.

The combination of a password (using a password manager) and a U2F key is more secure (Yubico also has U2F keys). U2F keys avoid phishing and most MITM attacks by generating a unique keypair per origin. Since a phishing site or MITM does not have the same origin, they cannot successfully complete a challenge-response with the key.

Also, AFAIR, Yubikey OTP requires the use of a Yubikey server which knows the shared secret, which may be problematic.

[ Parent | on HN ]
Re:A plastic card for easy to remember strong passwords by Nullabillity on Sunday January 11, 2015 @12:39PM (#8870534)
You can replace the Yubikey's OTP seed with your own to bypass their server. https://www.yubico.com/applications/internet-services/gmail/
[ Parent | on HN ]
Re:A plastic card for easy to remember strong passwords by danieldk on Sunday January 11, 2015 @01:19PM (#8870671)
Yes, but then it won't be supported by many sites that support Yubikey OTP and rely on Yubico's servers for authentication.
[ Parent | on HN ]