Yubikey support

akorvemaker · 19 Jan 2010, 11:30 PM

I just saw on Twitter that the beta server now supports Yubikey as an Alternative Login option.

Thanks! I'd love to have general OpenID support. I don't have a Yubikey right now, but this encourages me to look at it as an option.

I really appreciate the various login options.

Thanks FM! (This seems like the sort of thing that would be either Bron or Rob's work, but whoever did it, thank you!)

Andy

jackmfm · 20 Jan 2010, 04:21 AM

Currently we're just using the Yubikey online API. If you ever change your internal yubikey AES token, you would need to upload that to the Yubikey website.

It will stay on the beta site for a while until we can confirm the implementation is working OK for everyone.

Jack

kirill · 20 Jan 2010, 06:39 AM

I ordered two keys today - will test with FM and use it for my own stuff too.

sflorack · 20 Jan 2010, 11:01 AM

Yubikey + Fastmail + Lastpass = Good Stuff!

jackmfm · 20 Jan 2010, 07:29 PM

Rob has posted a discussion regarding Yubikey on the FastMail blog:

http://blog.fastmail.fm/2010/01/20/y...n-beta-server/

Jack

**ReuvenNY** · 20 Jan 2010, 10:33 PM

Where can we read more about the Yubikey, price and where to buy it?

scutworker · 20 Jan 2010, 10:41 PM

You can find out about the Yubikey here:

http://www.yubico.com/home/index/

Once question I have; do you just enter your username and press the Yubikey to log in, or is there some kind of PIN as well. I thought that with just the username and key what would prevent somebody stealing the Yubikey and using it if they knew your username too?

sflorack · 21 Jan 2010, 03:27 AM

Quote:

Originally Posted by scutworker

Once question I have; do you just enter your username and press the Yubikey to log in, or is there some kind of PIN as well. I thought that with just the username and key what would prevent somebody stealing the Yubikey and using it if they knew your username too?

"The $25 YubiKey is a tough little chunk of plastic with USB connectors on one end and a touch-sensitive (no moving parts) button on top. Each time you touch the button it sends a static password and a dynamically-generated one-time password to any application that's listening for its input. If a spy program captures the password, so what - that particular one-time password won't be valid ever again."

SOURCE: PC Magazine

Sounds like you'll still logon with userid/password, but then need to touch the Yubikey for finalizing logon.

qwertz123456 · 21 Jan 2010, 08:07 AM

Does anyone know if I can use ONE Yubikey for my Fastmail account and TrueCrypt or do I have to have two keys?

robmueller · 21 Jan 2010, 10:58 AM

Re: Yubikey + truecrypt

No unfortunately. There's actually a good description why here.

http://forum.yubico.com/viewtopic.php?f=6&t=215

1. Truecrypt needs a fixed password. You can configure your yubikey to do that, but then you lose the one-time password
2. You could in theory change the Truecrypt code so it uses the one-time password and contacts the yubico server, but that's not really possible to do in a pre-boot environment if you've got a whole encrypted HD

Rob

robmueller · 21 Jan 2010, 11:00 AM

Re: Password vs Yubikey vs Yubikey+Password

Basically the difference is "one-factor authentication" vs "two-factor authentication".

At the moment, the yubikey is replacing your password, so it's still one-factor. So if you lose your password (some bits of data) or lose your yubikey (physical), you're account can still be accessed.

I'm looking at adding two-factor authentication. In that case, you'd have a password AND a yubikey code. You'd need both to login. In that case, losing either one alone wouldn't cause a problem, only losing both would, which is a lot less likely.

Rob

kirill · 21 Jan 2010, 04:56 PM

Quote:

Originally Posted by robmueller

Re: Yubikey + truecrypt

No unfortunately. There's actually a good description why here.

http://forum.yubico.com/viewtopic.php?f=6&t=215

1. Truecrypt needs a fixed password. You can configure your yubikey to do that, but then you lose the one-time password
2. You could in theory change the Truecrypt code so it uses the one-time password and contacts the yubico server, but that's not really possible to do in a pre-boot environment if you've got a whole encrypted HD

Rob

Rob, the new keys support two configurations. I just programmed my yubikey to use a static password in addition to OTP. Short press on the key - OTP, long press - static password. This way, the key can be used with Truecrypt too.

kirill · 21 Jan 2010, 04:57 PM

The dual-configuration feature of yubikey 2 is described here:

http://forum.yubico.com/viewtopic.php?f=16&t=348

simbo1905 · 26 Jan 2010, 11:06 PM

I am keen to give my new key a go but I only know about the production servers. Where do I go to try out my key on the beta servers?

scutworker · 26 Jan 2010, 11:08 PM

The beta server is here:

http://www.fastmail.fm/beta

19 Jan 2010, 11:30 PM	#1
akorvemaker Master of the @ Join Date: Nov 2002 Location: Canada Posts: 1,015	Yubikey support I just saw on Twitter that the beta server now supports Yubikey as an Alternative Login option. Thanks! I'd love to have general OpenID support. I don't have a Yubikey right now, but this encourages me to look at it as an option. I really appreciate the various login options. Thanks FM! (This seems like the sort of thing that would be either Bron or Rob's work, but whoever did it, thank you!) Andy

20 Jan 2010, 04:21 AM	#2
jackmfm Member Join Date: Oct 2009 Location: USA Posts: 62	YubiKey Support Currently we're just using the Yubikey online API. If you ever change your internal yubikey AES token, you would need to upload that to the Yubikey website. It will stay on the beta site for a while until we can confirm the implementation is working OK for everyone. Jack

20 Jan 2010, 07:29 PM	#5
jackmfm Member Join Date: Oct 2009 Location: USA Posts: 62	Rob Has Posted on Blog Rob has posted a discussion regarding Yubikey on the FastMail blog: http://blog.fastmail.fm/2010/01/20/y...n-beta-server/ Jack

26 Jan 2010, 11:06 PM	#14
simbo1905 Junior Member Join Date: Jan 2010 Posts: 3	my yubikey arrived today. where is the beta server? I am keen to give my new key a go but I only know about the production servers. Where do I go to try out my key on the beta servers?

20 Jan 2010, 06:39 AM	#3
kirill Cornerstone of the Community Join Date: Jun 2001 Posts: 879	I ordered two keys today - will test with FM and use it for my own stuff too.

20 Jan 2010, 11:01 AM	#4
sflorack The "e" in e-mail Join Date: Feb 2002 Posts: 2,937	Yubikey + Fastmail + Lastpass = Good Stuff!

20 Jan 2010, 10:33 PM	#6
ReuvenNY Moderator Join Date: Mar 2002 Location: New York Posts: 4,259	Where can we read more about the Yubikey, price and where to buy it?

20 Jan 2010, 10:41 PM	#7
scutworker Member Join Date: Mar 2006 Posts: 44	You can find out about the Yubikey here: http://www.yubico.com/home/index/ Once question I have; do you just enter your username and press the Yubikey to log in, or is there some kind of PIN as well. I thought that with just the username and key what would prevent somebody stealing the Yubikey and using it if they knew your username too?

21 Jan 2010, 08:07 AM	#9
qwertz123456 Essential Contributor Join Date: Jan 2008 Posts: 378	Does anyone know if I can use ONE Yubikey for my Fastmail account and TrueCrypt or do I have to have two keys?

21 Jan 2010, 10:58 AM	#10
robmueller Intergalactic Postmaster Join Date: Oct 2001 Location: Melbourne, Australia Posts: 6,102 Representative of: Fastmail.FM	Re: Yubikey + truecrypt No unfortunately. There's actually a good description why here. http://forum.yubico.com/viewtopic.php?f=6&t=215 1. Truecrypt needs a fixed password. You can configure your yubikey to do that, but then you lose the one-time password 2. You could in theory change the Truecrypt code so it uses the one-time password and contacts the yubico server, but that's not really possible to do in a pre-boot environment if you've got a whole encrypted HD Rob

21 Jan 2010, 11:00 AM	#11
robmueller Intergalactic Postmaster Join Date: Oct 2001 Location: Melbourne, Australia Posts: 6,102 Representative of: Fastmail.FM	Re: Password vs Yubikey vs Yubikey+Password Basically the difference is "one-factor authentication" vs "two-factor authentication". At the moment, the yubikey is replacing your password, so it's still one-factor. So if you lose your password (some bits of data) or lose your yubikey (physical), you're account can still be accessed. I'm looking at adding two-factor authentication. In that case, you'd have a password AND a yubikey code. You'd need both to login. In that case, losing either one alone wouldn't cause a problem, only losing both would, which is a lot less likely. Rob

21 Jan 2010, 04:57 PM	#13
kirill Cornerstone of the Community Join Date: Jun 2001 Posts: 879	The dual-configuration feature of yubikey 2 is described here: http://forum.yubico.com/viewtopic.php?f=16&t=348

26 Jan 2010, 11:08 PM	#15
scutworker Member Join Date: Mar 2006 Posts: 44	The beta server is here: http://www.fastmail.fm/beta