Yubico Forum

General • [Community] - Forum going read only. New KDB on its way.

2018-01-30T09:26:55+01:00

For the security and experience of our user community, we have decided to set the forum as read-only and wipe all user account information. All historical posts and announcements will be archived and remain publicly searchable.

In 2018, we will be publishing a searchable knowledge-base system that allows the community to provide direct feedback on articles and make suggestions that will be reviewed by Yubico staff. We sincerely appreciate the participation of our user forum over the years and hope to continue serving your for years to come.

Statistics: Posted by Tom2 — Tue Jan 30, 2018 9:26 am

General • On-screen notification of blinking

2018-01-11T16:22:25+01:00

Hi,

I've got my yubikey plugged in my computer and it's sometime not easy to realize it's blinking. Is there any way to get a little notification on the screen, maybe simply through libnotify ?
Basically is the OS told in any way that the key is waiting for a touch, I don't mind having to hook it up myself if the info is available somewhere.

Statistics: Posted by Ulrar — Thu Jan 11, 2018 4:22 pm

General • Signing Certificates Missing?

2017-11-08T07:08:19+01:00

Hello Forum,

First time poster, so please forgive me if this is in the Wrong Location.

Just a curiosity... However the Software Signing Page shows a number of Certificates used to Sign the YubiCo Software, but seems to be missing some..
https://developers.yubico.com/Software_ ... gning.html

I am Specifically looking at the Windows Software Signing ones which indicate that the current Certificated is a GoDaddy Certificate, Which has expired (13/03/2017).

The Windows 10 Smart Card Drivers ykmd.dll & ykmd64.dll are signed with a DigiCert EV Certificate that is not listed on the Signing Page...
https://www.yubico.com/wp-content/uploa ... .3.1.5.zip

Expiry: 21/02/2020
Thumbprint: "‎01 02 92 88 56 2c 04 54 bc 0c bc 00 d4 1e 90 f1 b8 86 52 17"

The yubikey-piv-manager-1.4.2d-win.exe Is Signed with a GoDaddy Certificate that is not Listed on the Signing Page
https://developers.yubico.com/yubikey-p ... 2d-win.exe

Expiry: 13/03/2018
Thumbprint: "‎03 df 05 25 fe 4c 7f a9 a7 69 35 4c d9 f3 7a 42 b6 ca b6 69"

If this is a oversight are you able to Correct? Or is the software I have downloaded not "Genuine"

I'm guessing its just an oversight, but I'm also surprised that no one else has picked up on it yet...

Regards,
N

Statistics: Posted by Nillth — Wed Nov 08, 2017 7:08 am

General • Is there a Yubico roadmap? Things to look forward to?

2017-10-15T16:17:42+01:00

I am curious, do you have a roadmap with things you plan bringing to the Yubikey table? Things we can look forward to coming in the near future or farther future? Perhaps higher quality encryption on the Neo, or more slots or something?

Thanks.

Statistics: Posted by Morthawt — Sun Oct 15, 2017 4:17 pm

General • Re: Yubicloud/FIDO U2F

2017-10-12T22:03:00+01:00

https://developers.yubico.com/U2F/

Statistics: Posted by ChrisHalos — Thu Oct 12, 2017 10:03 pm

General • Yubicloud/FIDO U2F

2017-10-12T17:54:18+01:00

This is a heavily edited post, partly because I can't delete my original post, and partly because I got no replies from the original.

I've been looking into supporting the FIDO U2F Yubikey in an application that I've written. I can support the "regular" Yubikeys but I can find no way to get the input from a FIDO U2F Yubikey and can't seem to get started with it. Can anyone point me in the right direction?

Statistics: Posted by jeedee — Thu Oct 12, 2017 5:54 pm

General • Re: [Question] Upon too many PIV/Key management failures. Er

2017-10-09T19:26:56+01:00

Very nice. Thanks for letting me know.

Statistics: Posted by Morthawt — Mon Oct 09, 2017 7:26 pm

General • Re: [Question] Upon too many PIV/Key management failures. Er

2017-10-09T19:25:26+01:00

Three attempts to verify the PIN and the PIN is blocked. Three attempts to verify the PUK and the PUK is blocked. At this point the only option is to reset the PIV applet. Management Key is the only thing that can hypothetically be brute-forced, but the person with the management key can't use the certificate that's stored on the YubiKey. They would have to generate a new one to use the key. All scenarios are basically covered on our developer website. Recommend you start with https://developers.yubico.com/PIV/Intro ... ccess.html

There is no way to render the PIV applet completely useless (otherwise lots of customers will experiment, lock the PIV applet permanently, and demand a replacement). This isn't like a basic smart card where you lock it and you have to throw it away and buy another one. There are several other manufacturers that offer those.

Statistics: Posted by ChrisHalos — Mon Oct 09, 2017 7:25 pm

General • [Question] Upon too many PIV/Key management failures. Erase?

2017-10-04T18:38:30+01:00

If someone tries to use certs I have in my PIV, for, code signing say. They try and try and try, I assume it gets locked right? Are there any conditions where the Yubikey will "maliciously" (desired) destroy the key upon too many failures or anything? Or does it just "choose" to deny the usage of the contained keys and rely on the protection of the secure element to hopefully prevent forced physical access to the key information?

Clarification would be very helpful to know what is what.

Thanks.

Statistics: Posted by Morthawt — Wed Oct 04, 2017 6:38 pm

General • [BUG] Desktop Authenticator program - Password protection

2017-10-02T15:11:18+01:00

Background:
I have run into the problem after messing around with the password protection, due to wanting to experience the Windows Hello unlocking capability. The firs related problem was the fact that when I Remembered the password on a computer, I was unable to make the Authenticator app forget it, which was a big security problem for me at work as I like to unplug it, plug it back in and not enter the password, so that I can still make use of U2F. Well I went into the registry after searching many other data-storage areas and found how to remove the password that was saved.

Now to the current bug.
I had my password saved at home, because that is fine. But I removed the password setting by leaving everything blank as recommended. Then I tested the hello unlocking thing out, which was not too bad but really annoyed me that I could not secure my TOTP codes as well as making use of the hello. But then I plugged in my Yubikey and it asked for the password. I was confused as I had removed the password on the Yubikey in order to test Hello unlocking. So I entered nothing and pressed enter, thinking it would enter "no password" and just work. It failed and still wanted the password. I entered the password I normally use... still nothing. At first this prompted me to get annoyed and I reset it and added everything again, only to have the problem return through similar circumstances. Well, it turned out that when I went to change the password to be blank (to use hello for example) the password that was saved in the registry was not updated to reflect the new lack of a password.

Statistics: Posted by Morthawt — Mon Oct 02, 2017 3:11 pm

General • Re: [QUESTION] Activating screen saver on key removal macOS

2017-09-14T03:21:20+01:00

I figured it out. The auto screensaver on removal only works with the key that I initially login with. The other key is allowed to login with PIN, but only one can be used to activate the screensaver.

Statistics: Posted by teegee543 — Thu Sep 14, 2017 3:21 am

General • [SOLVED] Activating screen saver on key removal macOS

2017-09-14T03:22:00+01:00

I've configured two Yubikey NEOs using the Yubikey PIV manager to log me into my Mac running macOS Sierra 10.12.6 using a PIN. I can use either to log in, which is great. However, only the first one I programmed is able to automatically enable the screensaver when I unplug it when I activate Security & Privacy -> Advanced... -> Turn on screen saver when login token is removed.

I've tried everything I can think of:
- Program both keys to use the same certificate and key
- Program both keys to use the same PIN
- Program both keys to have the same HMAC-SHA1 secret key
- Re-pair both keys using the PIV Manager
- Pair only the non-working key using the PIV Manager

Both keys are firmware version 3.4.9. I have no idea why the second key just doesn't work.

Statistics: Posted by teegee543 — Thu Sep 14, 2017 12:45 am

General • How to create a forum account without a YubiKey

2017-04-21T02:29:09+01:00

I mentioned this in another post a couple of days ago, but I wanted to put this into a separate post so it's easier for people to find in the future.

Yubico has tried removing the Yubico OTP requirement to create a new forum account in the past, but when this is done, a large amount of SPAM is generated on the forum. To minimize this, we have the requirement to provide a valid Yubico OTP credential when you create a new account. We understand, however, that there are cases where a community member would like to post questions/comments that don't currently own a YubiKey, or do not wish to have a Yubico OTP credential on their YubiKey.

If you would like an account but don't have access to a valid Yubico OTP credential, you can simply contact the support team at yubi.co/support and request that we create an account for you. Please provide the following information:

- Your preferred username
- The e-mail address you want the account registered to (for self-service reset, like the process documented above)

We will get back to you by the next business day with the account details (typically within a few hours, depending on when we receive the request).

Statistics: Posted by ChrisHalos — Fri Apr 21, 2017 2:29 am

General • Unable to log in to the forum? (lost access to YubiKey, etc)

2017-04-18T17:50:20+01:00

If you lost access to the YubiKey associated to your forum account, you can recover access to your account without assistance from a Yubico employee (in fact, we don't have the ability to get you back into your account should you lose access). We can't reset your password for you, and we can't temporarily disable the YubiKey requirement on your account selectively.

So, if you can't access your account due to misplaced/broken YubiKey, etc., do the following:

(1) go to the login page of the forum

(2) Enter your username and password, leave the YubiKey OTP field blank, and click Login. You should see the following option added to the login page

(3) Click Reset YubiKey preferences. You should see the following screen

(4) Enter your Username and registered E-mail address and click Submit. An e-mail will be sent to your registered e-mail address, assuming the username and address combination is correct.

(5) Click on the link, which will remove the Yubico OTP requirement on your forum account.

(6) Return to the login page and login with your username and password.

(7) Click on User Control Panel at the top right.

(8) Click on Profile on the left.

(9) Click on YubiKey Manager on the left.

(10) In YubiKey Manager, you have the ability to:

- delete the registered YubiKey(s) you no longer have access to
- register a new YubiKey
- enable or disable the requirement for a YubiKey to log in

By resetting the YubiKey preferences on your account, the YubiKey(s) continue to be registered to your account, but the Yubico OTP requirement is no longer enabled, so you can simply continue logging in with your username and password only. We recommend re-enabling the OTP requirement for your protection, but it is an option.

Note about the OTP requirement to create a forum account

Yubico has removed the Yubico OTP requirement to create a new forum account in the past, but when this is done, a large amount of SPAM is generated on the forum. To minimize this, we have the requirement to provide a valid Yubico OTP credential when you create a new account. We understand, however, that there are cases where a community member would like to post questions/comments that don't currently own a YubiKey, or do not wish to have a Yubico OTP credential on their YubiKey.

If you would like an account but don't have access to a valid Yubico OTP credential, you can simply contact the support team at yubi.co/support and request that we create an account for you. Please provide the following information:

- Your preferred username
- The e-mail address you want the account registered to (for self-service reset, like the process documented above)

Statistics: Posted by ChrisHalos — Tue Apr 18, 2017 5:50 pm

General • Re: [SOLVED] Yubikey Public ID storage

2017-04-07T18:25:27+01:00

Thanks!

Statistics: Posted by jeedee — Fri Apr 07, 2017 6:25 pm