Yubico Forum

Re: Can a yubikey replace the paypal security key?

2011-02-26T05:58:16+01:00

As the page at http://www.yubico.com/vip suggests, please do check with PayPal before purchasing one if you intend to tie it with PayPal.

Besides Denmark, APAC is not covered under PayPal VIP program according to PayPal Customer Service. It looks like only US, Canada, and limited European countries are under VIP coverage.

On the other hand eBay works with my VIP token from my APAC account, but then it is another device not Yubikey, so I can't be sure the VIP-enabled Yubikey works as well for Asian countries.

It will be great if PayPal supports VIP globally

Statistics: Posted by pine — Sat Feb 26, 2011 5:58 am

Re: Can a yubikey replace the paypal security key?

2011-02-17T21:13:11+01:00

Dear Jakob,

what does proprietary to symantec mean. Does Yubico generate the HMAC and ship it to symantec or is it vice versa?
Or does symantec generate the HMAC, store it to the yubikey and ship the yubikeys (via you?)
This would make sence - since I think they (former verisgn) are running the backend?

Kind regards
Cornelius

Statistics: Posted by cornelinux — Thu Feb 17, 2011 9:13 pm

Re: Can a yubikey replace the paypal security key?

2011-02-17T19:38:50+01:00

The HMAC key is proprietary to Symantec so that cannot be retreived.

However, the second configuration is open for your own needs so please feel free to assign your own HMAC key there to be used with other applications.

Best regards,

JakobE
Hardware- and firmware guy @ Yubico

Statistics: Posted by Jakob — Thu Feb 17, 2011 7:38 pm

Re: Can a yubikey replace the paypal security key?

2011-02-15T23:33:12+01:00

Only learned about it today...

So good to hear, that this is possible with a well defined algorithm...

What about the HMAC key - I guess it is transferred to symantec in a secure manner.
Would it be possible to also get the hmac key, so that one could use the OATH token also with other applications?

Kind regards
Cornelius

Statistics: Posted by cornelinux — Tue Feb 15, 2011 11:33 pm

Re: Can a yubikey replace the paypal security key?

2011-02-15T22:26:33+01:00

Since quite recently - yes you can.

http://www.yubico.com/vip

At present, the keys are sent out pre-configured so current keys cannot be updated with a valid VIP key. We'll see what the future will give us

Best regards,

JakobE
Hardware- and firmware guy @ Yubico

Statistics: Posted by Jakob — Tue Feb 15, 2011 10:26 pm

Re: Can a yubikey replace the paypal security key?

2011-02-14T22:42:10+01:00

Hi there,

very obiously it is not possible due to two facts:

1. it depends on paypal what backend they are using. So the question is, if they would support the yubikey, integrate and chip it.

2. Paypal uses verisign keys, which are not oath compliant but use some unknown 3DES algorithm to calculate the one time password

Kind regards
Cornelius

Statistics: Posted by cornelinux — Mon Feb 14, 2011 10:42 pm

Re: Can a yubikey replace the paypal security key?

2011-02-05T01:35:17+01:00

I'm curious about this one, too...

Statistics: Posted by Jafo_Jeeper — Sat Feb 05, 2011 1:35 am

Can a yubikey replace the paypal security key?

2010-12-30T05:15:24+01:00

Is it possible to replace the paypal security key with the yubikey in OATH-HOTP mode set for 6 digits?

Statistics: Posted by cire1425 — Thu Dec 30, 2010 5:15 am