Yubico Forum

Re: What is the risk of verbose_otp when using OpenSSH?

2017-04-14T06:27:56+01:00

Hello Matthew,

Thanks!

Since Yubico OTP is input as USB keyboard, I think that keylogging is also possible without the verbose_otp option.
Is it wrong..?

When using two factor authentication with Publickey Authentication and Yubico OTP, the change with verbose_otp option will only display used OTP on the terminal.

Best,
saso

Statistics: Posted by saso — Fri Apr 14, 2017 6:27 am

Re: What is the risk of verbose_otp when using OpenSSH?

2017-04-13T18:03:58+01:00

Hello saso,

Setting the verbose_otp option is not recommended and can open your system to keylogging as it will also send and record the password along with the otp string.

Best Regards,
Matthew
Yubico Support

Statistics: Posted by mattlegitt — Thu Apr 13, 2017 6:03 pm

What is the risk of verbose_otp when using OpenSSH?

2017-04-13T12:54:09+01:00

Hello,

Thanks for great products!

In README, It says that verbose_otp can not be used in OpenSSH.
However, verbose_otp option can be used with OpenSSH_5.3p1

And in README,
> You are advised to not use this, if you are using two factor authentication because that will display your password on the screen.

What is the risk of verbose_otp when using OpenSSH?
Even if the used one-time password leaks out, it seems to be no problem because validation server does not accept OTP.

Thanks.

Statistics: Posted by saso — Thu Apr 13, 2017 12:54 pm