Yubico Forum
https://forum.yubico.com/

Reusing OTP passwords
https://forum.yubico.com/viewtopic.php?f=3&t=251
Page 3 of 3

Author:  ferrix [ Tue Feb 10, 2009 8:51 pm ]
Post subject:  Re: Reusing OTP passwords

zzap wrote:
Not to harp on this, but I am concerned no one from Yubico bothers to address my concerns. Is there really no interest from Yubico's side in explaining why the source code changes were made in the way they were?


I'm not from yubico, but I read and don't understand your concerns exactly. They check in repo changes as they are made.. I don't think that the source code repository is intended as a product of commercial quality, but rather a tool for the community.

I could be wrong.

Author:  zzap [ Sun Feb 15, 2009 8:44 am ]
Post subject:  Re: Reusing OTP passwords

Quote:
I'm not from yubico, but I read and don't understand your concerns exactly. They check in repo changes as they are made.. I don't think that the source code repository is intended as a product of commercial quality, but rather a tool for the community.

I could be wrong.


The Yubico public validation server runs off the key subsystem code in the public repository. The changes to the source that concerned me were made by a Yubico employee.

It's not unreasonable to expect the proper handling of tokens and OTPs in source that is created by the company selling the tokens. It's pretty hard to imagine any other token vendor exposing such borderline cavalier behavior to code correctness.

If you don't understand why the way Yubico deals with this bug -- its initial introduction by quick-and-dirty untested code changes and its subsequent attempt to fix by equally untested code change and complete silence on these facts when challenged -- is very dangerous, then I'm sorry but you don't understand enough about security and should be looking for a different solution.

Unless the Yubikey is just a toy, in which case shame on me for thinking otherwise.

Page 3 of 3 All times are UTC + 1 hour
Powered by phpBB® Forum Software © phpBB Group
https://www.phpbb.com/