[ale] Yubikey

[Scott Bragg]

I've been using one with LastPass for a couple of years now.  I use
two-factor to activate LastPass on a system, then let lastpass manage all
my passwords.

Simple and effective.

For your banks, etc.. The website would have to implement 2-factor and
allow the ubikey as one of the factors.   To the best of my knowledge, none
of the US banks do this yet.   The closes is Chase that requires a 4digit
key that gets sent vial e-mail or SMS to an e-mail address or phone on my
account when I log in from a computer for the first time.

E-trade has started doing that as well as asking me questions about things
on my credit history to authenticate me.  Guess that's multi-factor taken
almost too far.    User/pass + SMS code + 5 questions from credit report ==
7 factor?

Scott



On Mon, Mar 4, 2013 at 9:29 PM, Mike Harrison <cluon at geeklabs.com> wrote:

> http;//yubikey.com
>>>
>> Steve Gibson talks about those quite a bit.  Is there a way to use them
>> for external things, like your bank?
>>
>
> If the bank supports them, yes.
>
> they don't store passwords, they create one time use incremental tokens...
>
> They aren't uber-high level freaky James Bond / Bruce Schnier secure..
> but they are an effective and very very well done level
> with a good price point for devices and reasonable implementation pain.
>
> That makes them desirable and useful as the 2nd factor.. (or third.. or.. )
> Useful and used makes them better than uber-quantum secure and hard to
> implement and therefor not used.
>
>
>
>
>
>
> ______________________________**_________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/**listinfo/ale<http://mail.ale.org/mailman/listinfo/ale>
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/**listinfo<http://mail.ale.org/mailman/listinfo>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.ale.org/pipermail/ale/attachments/20130305/c9dd3a42/attachment-0001.html>