Yubico Forum ...visit our web-store at 2010-07-22T12:00:34+01:00 https://forum.yubico.com/feed.php?f=4&t=550 2010-07-22T12:00:34+01:00 2010-07-22T12:00:34+01:00 https://forum.yubico.com/viewtopic.php?t=550&p=2284#p2284 <![CDATA[Re: Lost/damaged key replacement questions]]> Two or more than two YubiKeys can be configured to emit a same static password by programming them using the same programming parameters like same AES Key, same Public ID and same Private ID. For more information please visit the following post:
http://forum.yubico.com/viewtopic.php?f=6&t=513

For login to online services, Yubico provides the OTP validation service, the Web Service API and corresponding clients in various programming languages that can be easily integrated by application developers.

Regarding replacing the lost OTP, it really depends on the application if it provides the administrators to reassign a new key to the user. However, to avoid unauthorized use of the lost YubiKeys (OTP validation), Users/Client administrators can enroll their YubiKeys with the YubiRevoke Service (https://admin.yubico.com/yubirevoke/login.php ). YubiRevoke service allows to disable (or re-enable) specific YubiKeys on the Yubico Validation Service in case they are lost. This is very effective in preventing any potential misuse of YubiKeys if they fall in the wrong hands.

Statistics: Posted by samir — Thu Jul 22, 2010 12:00 pm

]]> 2010-07-12T12:24:38+01:00 2010-07-12T12:24:38+01:00 https://forum.yubico.com/viewtopic.php?t=550&p=2272#p2272 <![CDATA[Lost/damaged key replacement questions]]>
I am thinking of deploying the Yubikey in a number of scenarios such as accessing encrypted volumes or login to local or web services.

Am I correct in believing that for accessing encrypted volumes I must use a static password? If the yubikey is lost or damaged is it sufficient to program another yubikey with the same password or do I need to somehow clone the old yubikey?

For login to online services it would be nice to consider a one time password usage however this will require extra processing at the server to validate the passwords, correct?.

Is replacing lost OTP yubikeys feasible or is it only realistic to issue a new yubikey to that user and revoke the old one. If this is the case then do all yubikey installations ultimately hinge on a static password as OTP devices are vulnerable to loss or damage and are thus not reliable for master key usage?

In brief, what is best practice for replacing lost or damaged yubikeys either static or OTP?

Statistics: Posted by eduqate — Mon Jul 12, 2010 12:24 pm

]]>