Hacker News Reader

Comment by teagee | Hacker News Reader

Do you have a link to the docs that shows this? From what I can find on their site [1] it only supports a few of the protocols:

-Static Password

-HMAC-SHA1 Challenge-Response

-OATH-TOTP (Yubico Authenticator)

[1] https://support.yubico.com/support/solutions/articles/150000...

View on HN

It works very well for TOTP, just initialize all the keys at the same time. You can also print the qr code on paper as an additional layer of backup which makes it easier to add a new key if you destroy yours. Obviously if it was lost, you’d want to invalidate that and reset it up, but if run over by a truck and you’re holding the pieces, it’s easier than setting up all of them again.

IMHO the YubiKey is not useful for any of those. It's excellent for storing OpenPGP keys and U2F, reasonably good for X.509 (as much as expected for X.509 I guess), and not good for much else. Using it for TOTP IMHO makes no sense, it's better to use your phone.

Using it for TOTP makes sense if you have more than one phone or want to use TOTP on your desktop through Yubico authenticator.

Authy is excellent for this. I've got it on my phone and tablet. I'm reluctant to use it on my desktop because I don't want to type in a huge password but I regard my 2015 MacBook as less secure than my devices that are protected by touch. You might be OK with that or have a laptop with touch ID.

Exactly. Additionally phones can be rooted and that exposes the underlying secret but Yubikeys are tamper resistant.

Reply on news.ycombinator.com