Yubico Forum

Hello,

I have configured my Yubikey NEO to my liking on a computer. Slot 1 is configured for OTP, and works with LastPass and Google Apps. Slot 2 is configured for a static password to log me into LastPass without having to enter the master password each time.

The last thing I would like to do is configure the Yubikey to communicate the static password to my Android device to fill in my LastPass master password.

Is this possible? Do I have enough slots to do what I want to do? I want to keep the current configuration and simply add NFC capability for the static password.

Ok. So I have found several posts on this topic but can't get them to work. Seems pretty straightforward.

1) Go into Tools -> NDEF Programming.
2) Select Configuration Slot 2.
3) Enter NDEF Payload as -> https://lastpass.com/mobile/?otp=

This opens up the LastPass app, but it never receives the password.

If I use the default "https://my.yubico.com/neo/", this works with YubiClip. Is YubiClip safe enough to use on Android?

Any ideas what I'm doing wrong, or should I move my question to the LastPass forums?

...You cannot have 2 different information flying over NFC

You either sent the OTP ...OR... you send the password.

Well I don't have 2 different pieces of information "flying". As per my previous posts, I configured the first slot for OTP. The second slot is configured for a static password that I send over NFC. This works.

Where I am having trouble is trying to configure the Yubikey, as per the forums at Lastpass and Yubico, to send the static password to my phone's Lastpass app. I can get it to work using the YubiClip app, but this is a security issue because the YubiClip app doesn't clear the clipboard like it's supposed to, and I'd rather not have to manually do it every time I want to use Lastpass if I don't have to.

Basically, I paid $50 for a piece of hardware that came with a slip of paper that says "yubico.com" instead of instructions on what it claims it can do.

The usual setup with LastPass, IMHO, is to enter the Master Password manually, then use a Yubikey NEO for a Yubikey OTP. This is much more secure than using a NEO for a static Master Password, also it doesn't require the Yubikey to be reconfigured from the factory NDEF configuration.

The NEO you use when mobile has to be in Yubikey slot 1 on your LastPass account, otherwise the 2FA fails on the Android app in my experience. Moreover, you may need to change your Master Password after changing the slot 1 contents before things start working correctly in the app.

You should configure a backup form of 2FA - another Yubikey if you have one or another method as an alternative.