Heads up - for people who want Yubikey for 2FA on FastMail

[ioneja]

Hey guys, thought I'd share this deal I just saw (and just took advantage of as well). If you use (or want to use) Yubikey for 2FA on FastMail, there is a super price on Yubikeys right now, which I guess is just for the holidays... not sure when it expires.

It's 4 Yubikeys for $59. Which is really great, because 1 Yubikey normally costs $25. On top of that, you also get 2 LastPass premium subscriptions, so this price is actually kind of insane. 4 Yubikeys + 2 LastPass for $59? No brainer for me, and I picked up some more for myself and a friend.

As a Yubikey user I had to pass this along. No offense to those who don't like deals posted in the forum. I don't gain anything from this. And anyone who knows my posts in this forum knows I'm not someone who posts deals like this, ever. But this one was really too good not to post for anyone who cares for FastMail + 2FA, and could benefit anyone who wanted to pick up some Yubikeys for a great price during the holiday season, and these work great IMO.

Here's the link:

https://www.yubico.com/2014/11/speci...-living-color/

[steventay]

https://www.yubico.com/products/yubikey-hardware/

Happy New Year: $79 + free basic shipping*
We have minted a limited edition run of three festive colors for a special YubiKey that exclusively supports the two most used YubiKey protocols – U2F (for Google Accounts) and One-Time Password (for a host of other services).
(Note: This device is not a YubiKey NEO and has no support for CCID applications or NFC capability).

Happy Holidays: $59 + free basic shipping*
Secured passwords for two. Do you want to manage your passwords with LastPass and secure them with a Yubikey? This special holiday bundle has four YubiKeys AND two LastPass Premium Subscription licenses. Holiday price is nearly 50% off regular pricing.

if have U2F and NFC will be perfect.

[NumberSix]

So.... I'm still reading up on this stuff and trying to figure out what I need/want... and I wonder if I should prefer the colored Yubikeys because they support U2F in addition to OTP? How important is U2F, or will it be? Maybe we don't know yet...?

[robn]

Originally Posted by NumberSix

So.... I'm still reading up on this stuff and trying to figure out what I need/want... and I wonder if I should prefer the colored Yubikeys because they support U2F in addition to OTP? How important is U2F, or will it be? Maybe we don't know yet...?

Right now we support Yubikey OTP and TOTP modes, so of the standard product lineup, all except the U2F key (the blue one). The "Christmas" OTP+U2F keys will also work.

I've just today ordered a bunch of the Christmas keys and a couple of Neos for FastMail staff. We'll be experimenting with U2F in the new year. No commitment to implement anything, of course

[steventay]

YubiKeys PREMIUM NEO seem good

maybe i get the 3 Limited edition colored YubiKeys U2F + OTP first.

[danieldk]

Originally Posted by NumberSix

So.... I'm still reading up on this stuff and trying to figure out what I need/want... and I wonder if I should prefer the colored Yubikeys because they support U2F in addition to OTP? How important is U2F, or will it be? Maybe we don't know yet...?

U2F is more secure than OTP. OTP is still very sensitive to man in the middle attacks and phishing sites, the intermediary can just request the one-time password and forward it the the actual site. The primary attack vector it protects against is if someone gets your password. They would also need your (T)OTP device to gain access to the account.

U2F is much more secure against phishing/MITM attacks, because the token uses a key handle to select for the keypair used for the challenge-response. Since the MITM does not have the right key handle, it does not select the keypair and so the challenge-response cannot proceed.

(Cheap U2F devices do not actually store the keypairs on the device, but that is an implementation detail that should not weaken security. The keypair is stored by the service provider, but encrypted using the protected device key.)

[steventay]

Originally Posted by danieldk

U2F is more secure than OTP. OTP is still very sensitive to man in the middle attacks and phishing sites, the intermediary can just request the one-time password and forward it the the actual site. The primary attack vector it protects against is if someone gets your password. They would also need your (T)OTP device to gain access to the account.

U2F is much more secure against phishing/MITM attacks, because the token uses a key handle to select for the keypair used for the challenge-response. Since the MITM does not have the right key handle, it does not select the keypair and so the challenge-response cannot proceed.

(Cheap U2F devices do not actually store the keypairs on the device, but that is an implementation detail that should not weaken security. The keypair is stored by the service provider, but encrypted using the protected device key.)

Cheap U2F devices..... not YubiKeys correct?

[danieldk]

Originally Posted by steventay

Cheap U2F devices..... not YubiKeys correct?

Also Yubikeys (at least their U2F-only key). But again, it does not reduce security much. The private key is stored by the service provider (e.g. Google) as a part of the key handle, but it is encrypted using the secret on-device key and can only be decrypted by the device.

From Yubico's FAQ:

There is no practical limit to the U2F secured services the Security Key can be associated with. During the registration process, the key pairs are generated on the device (secure element) but the key pairs are not stored on the Security Key. Instead, the key pair (public key and encrypted private key) are stored by each relying party/service that initiated the registration. Therefore, this approach allows for an unlimited number of services to be associated with the Security Key.

From the spec:

A key goal of this program is to enable extremely inexpensive yet secure devices. To
enable new secure element chips to be as inexpensive as possible it is important to
allow them to have minimal or no onboard memory.

A U2F device allows for this. The Key Handle issued by the U2F device does not have
to be an index to the private key stored on board the U2F device secure element chip.
Instead, the Key Handle can 'store' (i.e., contain) the private key for the origin and the
hash of the origin encrypted with a 'wrapping' key known only to the U2F device secure
element. When the Key Handle goes back to the secure element it 'unwraps' it to
'retrieve' the private key and the origin that it was generated for.

U2F seems like a sound approach. It has two obvious weaknesses:

1. If you were MITMed at the time of registering the key, then all is lost (obviously).
2. You have to believe that the producer of your key does not know the secret key in the secure element.

But (T)OTP has the same weaknesses and many more.

[steventay]

oic..

i wonder U2F on NFC.

NFC good for mobile on the move...

[danieldk]

Originally Posted by steventay

oic..

i wonder U2F on NFC.

NFC good for mobile on the move...

That standard is not finalized yet. Neither U2F over Bluetooth.

[17pm]

This is a really good offer.

I just bought 1 yubikey standard to use with FM and will not be using this offer... For now, 1yubikey is enough for me. I'll be buying another one in a month or so, to keep in a safe.

Yubico seem to be an amazing company with great customer service..