Yubico Forum

YubiKey 1.x | 2.x | VIP • [Community] - Forum going read only. New KDB on its way.

2018-01-30T09:26:55+01:00

For the security and experience of our user community, we have decided to set the forum as read-only and wipe all user account information. All historical posts and announcements will be archived and remain publicly searchable.

In 2018, we will be publishing a searchable knowledge-base system that allows the community to provide direct feedback on articles and make suggestions that will be reviewed by Yubico staff. We sincerely appreciate the participation of our user forum over the years and hope to continue serving your for years to come.

Statistics: Posted by Tom2 — Tue Jan 30, 2018 9:26 am

YubiKey 1.x | 2.x | VIP • Re: [QUESTION] Nano static password outputs wrong character

2017-12-29T07:52:11+01:00

Okay, oddly this issue seems to have resolved itself.

I messed around with some commands, including `xkbcomp`, `xmodmap`, and `setxkbmap`. I also performed a system update with `pacman`.

I'm not sure what specifically fixed it, but it works as expected now.

I'm not sure if I should mark this thread as [SOLVED] because I don't know what the solution was.

Statistics: Posted by b0o — Fri Dec 29, 2017 7:52 am

YubiKey 1.x | 2.x | VIP • [QUESTION] Nano static password outputs wrong characters

2017-12-21T08:11:59+01:00

I've had both a Yubikey Standard and a Yubikey Nano for quite a long time now, and my main use case involves static passwords.

Both my Standard and Nano are set up with the same static password in slot 1. All of my machines and Yubikeys are configured to use the en-US keyboard layout.

Everything has always worked great on all systems I've tried (Linux, OSX, Windows) for both Yubikeys until recently.

My problem started unexpectedly about a week ago:

When I trigger slot 1 of the Nano on my primary Linux machine, many of the characters are incorrect. Oddly, though, triggering slot 1 of the Standard outputs the correct characters. When I trigger the same Nano on another machine running macOS, the static password is output correctly.

Prior to this, both Yubikeys had been working as expected on this machine/OS for 6+ months. Around the time things stopped working, I didn't change any configuration settings on either Yubikey (I didn't even have the tools installed), and I didn't change any settings on my system which should have any affect on this. The only thing I can think of that may have caused this would be updating some program via my package manager, but I can't pinpoint what that may have been.

For reference, my machine is a Mid-2014 Macbook Pro (MacBookPro11,3) running Arch Linux (Linux 4.14.5-1-ARCH x86_64 GNU/Linux).

My Standard is Firmware Version 2.3.3, and my Nano is Firmware Version 4.3.3.

Here are some sample outputs from both Yubikeys with the specified static password programmed:

Code:

Static password:   abcABC123!@#
Yubikey Standard:  abcABC123!@#
Yubikey Nano:      abcaBC123123
----
Static password:   qwertyuiopasdfghjklzxcvbnm
Yubikey Standard:  qwertyuiopasdfghjklzxcvbnm
Yubikey Nano:      qwertyuiopasdfghjklzxcvbnm
----
Static password:   QWERTYUIOPASDFGHJKLZXCVBNM
Yubikey Standard:  QWERTYUIOPASDFGHJKLZXCVBNM
Yubikey Nano:      qwertyuiopasdfghjklZXCVBNM
----
Static password:   `1234567890-=~!@#$%^&*()_+
Yubikey Standard:  `1234567890-=~!@#$%^&*()_+
Yubikey Nano:      `1234567890-=`1234567890-=

The only clue I may have found as to why this may be happening is the XKB keymaps for each Yubikey:

Code:

/bin/bash $ # find each Yubikey's device number
/bin/bash $ lsusb | grep Yubi
Bus 001 Device 025: ID 1050:0010 Yubico.com Yubikey (v1 or v2)
Bus 001 Device 022: ID 1050:0407 Yubico.com Yubikey 4 OTP+U2F+CCID
/bin/bash $ # output the loaded XKB keymap of each Yubikey
/bin/bash $ xkbcomp -i 025 $DISPLAY /tmp/yubikey-std.xkb
/bin/bash $ xkbcomp -i 022 $DISPLAY /tmp/yubikey-nano.xkb

I've uploaded both of the XKB files as well as a diff on GitHub Gist:
yubikey-std.xkb: https://gist.github.com/b0o/b681522b069 ... ey-std-xkb
yubikey-nano.xkb: https://gist.github.com/b0o/b681522b069 ... y-nano-xkb
diff yubikey-std.xkb yubikey-nano.xkb: https://gist.github.com/b0o/b681522b069 ... ikeys-diff

I'm not exactly sure how or why Linux decided to assign each Yubikey a different XKB keymap by default, because I have done nothing to change this myself.

Any help would be appreciated, I can provide more information upon request.

Thank you!

Statistics: Posted by b0o — Thu Dec 21, 2017 8:11 am

YubiKey 1.x | 2.x | VIP • Re: upload to aes serve help

2017-11-09T19:28:24+01:00

This thread is almost 7 years old.

https://www.yubico.com/wp-content/uploa ... ide_en.pdf

Statistics: Posted by ChrisHalos — Thu Nov 09, 2017 7:28 pm

YubiKey 1.x | 2.x | VIP • Re: upload to aes serve help

2017-11-09T15:25:07+01:00

"Page not found"

I'm having the same issue after re-programming my Yubikey 4. I've uploaded new keys in the past, I know how the process is supposed to work, but this time it's not working.

Statistics: Posted by jms1 — Thu Nov 09, 2017 3:25 pm

YubiKey 1.x | 2.x | VIP • Re: USB3 problem with one key only

2017-10-19T16:11:34+01:00

I have this same problem with all of my Yubikeys. I have all the latest drivers too. I have no hubs to test, what I can say is my USB3 ports work with absolutely everything else. Not a single problem until I come to use the Yubikey in them. Also, the problem seems mainly surrounding U2F only. Even challenge and response works. I have a ticket out, I do not recall if I added this detail though.

Statistics: Posted by Morthawt — Thu Oct 19, 2017 4:11 pm

YubiKey 1.x | 2.x | VIP • Re: RIP to my Yubikey (869937) v2.2.2 - Obituary

2017-10-15T20:34:09+01:00

I have had no luck with using the NDEF part of it. I can get openpgp to work partially due to a software bug, I can get the TOTP codes to display but the OTP types of facility do not work since the Yubiclip app does not work on my S5 mini.

Statistics: Posted by Morthawt — Sun Oct 15, 2017 8:34 pm

YubiKey 1.x | 2.x | VIP • Re: RIP to my Yubikey (869937) v2.2.2 - Obituary

2017-10-15T19:50:49+01:00

One of the best things about the newer yubikey Keys is with the u2f and ccid capabilities you can do so much more than just store static passwords. On Android with NFC you can set the ndef that appears when the yubikey is scanned and trigger actions based on that in addition to using the NFC to send the otp.

Statistics: Posted by dragon788 — Sun Oct 15, 2017 7:50 pm

YubiKey 1.x | 2.x | VIP • RIP to my Yubikey (869937) v2.2.2 - Obituary

2017-10-02T14:55:30+01:00

Well, I bought my Yubikey (v2.2.2 firmware) back in 2011. I never really found much use for the Yubico OTP since only this forum accepted it (still is the only site I use that accepts it) so the most I used it for was occasionally when my interest peaked again, the windows login protection using SHA1-HMAC challenge-response and also a static password which I used as a postfix to site-specific subjective meta information to essentially ensure each site had a unique password which the "system" was extremely difficult to decipher.

Well after some years of only using it for the static password I had a problem with my computer which required me to use my phone more, which meant I had to memorise the random password stored in the Yubikey since I could not use it on my phone. Also I had a strange intermittent problem where the computer would stop reading the Yubikey and I had to take it out, clean it and reboot the computer. I am still unsure exactly what the problem was but it was very inconvenient having a locked PC with no ability to unlock, losing unsaved work etc upon reboot. So I eventually stopped using the Yubikey because I just knew the "random" password components to type. So it sat in draws, shelves, moved around and not used for a couple years. Until somewhat recently when I found it and decided to start using it again. I researched and a new "Yubikey 4" was out and decided to order it for the numerous new benefits. I love the Yubikey 4 and had plans next pay day to buy the neo and hope and pray that a newer one with even more capabilities doesn't come out and annoy me to spend more money. But now my old Yubikey 2.2.2 has stopped working. I cleaned the contacts, rebooted (after forgetting about this old problem, through not using it for so long) and it still did not work.

I tried using specific contact cleaner, nothing, tried using "Peek" polish which is a metal/plastic cleaner which does a magical job of cleaning metal. It took off a bit of the gold plating off but still was dead. I filed the end of the Yubikey to hope to push it in a bit further and get the USB contacts to contact a bit further up than normally would be contact with and still dead. I took a 2000 grit knife sharpening stone and give it a quick few light swipes and more gold came off and still dead. So I officially have safely, securely retired it using the wire cutters of my Gerber MP600 multi-tool and totally destroyed it.

I have shifted some money around and decided to order the neo early and cut my spending down till pay day, so that I a) have 2 Yubikeys again and I hope to use the NFC capability so I can get my TOTP codes off the google authenticator and solely make use of Yubico's desktop and android authenticators.

If anyone reads this, are there multiple benefits of having NFC? I know I can have about 30 TOTP entries stored on that and use the app but are there any other simultaneous benefits that I can get by having a neo?

Thanks.

Statistics: Posted by Morthawt — Mon Oct 02, 2017 2:55 pm

YubiKey 1.x | 2.x | VIP • Re: How do I get early (2.0.2) Yubikey to work with Keepass?

2017-10-02T14:34:24+01:00

Rcdadaptor wrote:

Any clues how to get a non oath equipped yubikey (firmware 2.02) to work using keepass 2fa?

I can do it via Google authenticator and 'phone, but that is too clunky as it requires manually entering 6 digit codes to a minimum of three (up to six) boxes. I'd like to just press the key 3 (or 4,5,6) times. (Extra question - can a longer custom string than 8 be used to maintain strength with fewer entries? e.g. can a plug in be written that say accepts a single otp that is longer than the 6-8 oath spec?)

I have an old yubikey that is non oath equipped that owes me nothing, and I'd rather not spend $40-50 to get a yk4 just for this purpose.

Have looked everywhere, for plug ins libraries etc to use yubicloud instead but either I'm not phrasing the question correctly or it hasn't been done.

Could I write my own plug in, to validate a key to unlock the vault? I am using windows 10 x64, Keepass 2.35, and optkeyprov 2.5(for Gauth so far). I'm not a programmer but can follow clear instructions!

Thanks if there is anyone out there who knows!!

edit - revised title to seek answers (rather than suggest I have the answer!)

I have tested this one which uses the SHA1 challenge-response and it seems to work well, although I do not understand the purpose of why it needs to know the secret used on the Yubikey for the challenge because if it sends data to it, it should always get the right response. But I did not write the plugin so I am sure there is a reason why it needs it. I just hope that the secret is used/stored securely. https://brush701.github.io/keechallenge/

Statistics: Posted by Morthawt — Mon Oct 02, 2017 2:34 pm

YubiKey 1.x | 2.x | VIP • Yubikey Sign returns 191 error

2017-09-29T04:20:32+01:00

In the last few days all yubikeys have started to return 191 errors for U2F sign operations.
Register works fine..
But all sign operations immediately return status errors?
Thoughts?

Statistics: Posted by rayjoyce — Fri Sep 29, 2017 4:20 am

YubiKey 1.x | 2.x | VIP • Re: yubikey VIP and paypal: No longer working?

2017-08-03T03:10:22+01:00

I guess there's no sense in me starting a new thread since this is still on the front page.

I have two relatively old VIP keys that no longer work with Symantec VIP. I haven't actively used them for a long time because they would constantly become out of sync with eBay and Paypal (I had disabled the tokens and just used the Yubico OTP on them).

Currently my attempts to test/validate Yuibkey VIP OTPs using this website don't work: https://vip.symantec.com/
I am also unable to reactivate the tokens in Paypal as it looks like eBay has completely abandoned Symantec VIP functionality.

Is it possible that Symantec VIP service has purged my keys/credentials for inactivity or they are just so out of sync that it shows invalid?

-- Edit --

So I managed to get it working and the issue was user error. When going to vip.symantec.com you first need to enter the serial number of the Yubikey, (ub the UBHExxxxxx format, some keys did not have UBHE prefix). After synchronizing this, I was able to get Paypal 2F enabled.

Statistics: Posted by nblyumberg — Thu Aug 03, 2017 3:10 am

YubiKey 1.x | 2.x | VIP • Re: [QUESTION] Yubikey 4 Blinking behavior

2017-06-29T09:26:19+01:00

I just received a Yubikey 4 Nano replacement for my old, broken nano and noticed the blinking immediately. Using the information in this post I was able to use the NEO Manager to disable the CCID protocol to stop the blinking.

However, I'm a loss to understand why the blinking is necessary in the first place. In fact I just discovered that my Yubikey could be used to store GPG keys/sub-keys. This would come in extremely handy in daily use, except for the fact that enabling CCID causes my Yubikey to blink every couple of seconds, nonstop. The blinking is just out of my sight and unbearable. I've turned off CCID mode to retain my sanity.

If this blinking behaviour is on purpose and unstoppable (while using the CCID protocol) then my opinion of Yubikey just got downgraded. I still like the product but will no longer shout its praises from the rooftop (or my office) and that makes me sad.

Statistics: Posted by RNHurt — Thu Jun 29, 2017 9:26 am

YubiKey 1.x | 2.x | VIP • Re: Question about overwriting Slot 1

2017-06-24T17:56:56+01:00

Apologies, you are correct, this functionality wasn't added until firmware 2.3. Yes, correct as well, the warning is just to tell you that you can't recover the default credential (Yubico OTP credentials beginning with "cc" can only be programmed by Yubico programming stations - user programmed credentials need to begin with "vv").

Statistics: Posted by ChrisHalos — Sat Jun 24, 2017 5:56 pm

YubiKey 1.x | 2.x | VIP • Re: Question about overwriting Slot 1

2017-06-24T11:59:48+01:00

Thanks very much for that. Swapping the Slots sounded a great idea, but I can't seem to be able to see the option to do that. The "Update Settings" button within the Settings tab in the Personalization Tool, is greyed out for me and states "Update is available for Yubikey 2.3 and later" above it. Does that mean my Yubikey, which is 2.2.3, can't swap the slots?

If I can't swap the slots, I shall do the first method that you suggested. I take it that the warning about not ever being able to undo this action, basically means that you can't get your exact original OTP details back on, but you can programme a new one which could be used in the future with a new provider. Am I correct with that? Sorry about not knowing this fully, I just wanted to ask because when something says you can't undo it, you need to be sure what the consequences are!

Thanks again, I appreciate it.

Statistics: Posted by IDPPKC — Sat Jun 24, 2017 11:59 am