Comments on: Yubico’s Ubiquitous to be Yubikey

By: museekero

museekero — Sat, 12 Dec 2009 11:53:17 +0000

hi, nice blog you have here.. care for exchange link?..my site http://museekero.com
please visit and post ur comments. thanks. godbless.

By: Jeff

Jeff — Sat, 04 Apr 2009 13:00:38 +0000

The Yubikey is not a mass storage device, it only acts as a USB keyboard when plugged into a computer. This is why it can work as a one-time password device on just about any computer with a USB port.

By: Nico

Nico — Thu, 04 Sep 2008 10:24:02 +0000

Judging from the available documentation, Yubikey is based on standard mass storage, which cannot be considered as a secure element like smartcards. As far as security is concerned, you can consider your Yubikey compromised as soon as somebody else can have it long enough to study it.

Second main issue: by construction, AES keys for all users need to be stored in clear on the server side. Consider the system compromised as soon as you had an intrusion on the server (read-only access would be sufficient).

Two weaknesses that tend to place Yubikey in the range of low-order security. This might be an issue, depending on what you are trying to protect.

By: Bobbysan

Bobbysan — Wed, 20 Aug 2008 18:23:42 +0000

I bought one to test it out. I’ve been using it on mashedlife also and will be buying another as a backup. If I would have known better, I could have saved on shipping by ordering both at the same time. They sent it priority mail and I had it in about 3 business days from the time I placed the order.

By: Max

Max — Thu, 07 Aug 2008 08:14:11 +0000

After reading your blog, I completely agree. I’ve been using the Yubikey for a few weeks now and I’m in love. It just makes logging into certain sites so easy. I know that not every site supports it yet, but I sure hope they will soon!

Also, using the Yubikey with other password sites is great. This one site I use, Mashedlife, is a password management site. It stores all my passwords online and lets me log in with one click. Using my Yubikey to log in there it really secure. Since my Yubikey logs me in, and Mashedlife remembers my other passwords, this is a relationship that makes life great. I’d say you should go check it out. Just go to http://www.mashedlife.com

Thanks for the great blog post!

Regards

By: Smart Card Guy

Smart Card Guy — Tue, 10 Jun 2008 18:04:52 +0000

I’m a smart card guy at martsoft.com but fed up with the support overhead of readers, CCID/PCSC/drivers, CSP/PKCS#11, … every time an upgrade of PC, a patch to OS, made ~ 50% of my customers’ smart cards stop working and we need to upgrade the drivers, diagnose the problem, and most people give up on smart card projects finally as we all know.

Weeks ago I ordered YubiKeys and integrated with 3 strong auth projects painlessly, and reduced these customers’ support overhead to almost zero, I’m converted by YubiKey now. It is the best compromise for the mass market.

By: rey

rey — Wed, 04 Jun 2008 09:18:33 +0000

I’m seriously considering ordering my own.

By: Snow White

Snow White — Tue, 03 Jun 2008 17:09:42 +0000

Bought 5 Yubikeys and use it on Mashed Life for my wife, kids, and my Mom. This is a great convenience device + service that enhanced our experience on the net.

Especially my kids and my mom can never keep track of their growing # of passwords online in gaming, photo sharing, and family blogs. They can’t even remember the URLs and this solves a lot of my daily role as IT support at home.

Thanks for the great story!