|
Hello, I was very excited to get my Yubikey Neo. My plan was to use the Neo w/NFC to authenticate on my Android GS3 running KitKat courtesy of CyanogenMod. In theory it seemed like a perfect solution. A dream for securing Google Services Acct, especially in light of the Heartbleed vulnerability. This dream quickly turned into a nightmare. First of all, when your YubiKey arrives, it comes with actually zero documentation, leaving the enduser to scour the web site for the most relevant/recent setup instructions. And there are many, fragmented articles/guides for different pieces of the puzzle. It seems like a perfect example of a company so deep in the trees that it doesn't realize it can't describe what a forest is. But, I suppose most customers actually have a clear idea what purpose they are acquiring a YubiKey for. Just don't expect a clear, end to end piece of documentation. But, I've been in IT for a long time and have been both mired in the forest,, and admired it from outside. Analogies aside. I got the YubiKey Neo configured, which wasn't a simple task, especially since apparently the config corrupted immediately after configuring slot 2. Several hours of frustrating troubleshooting (FAQs were useless) led me to delete the entire config and start from scratch. Good, I got LastPass working pretty quickly, followed a found pdf on enabling 2FA on Google Services/Gmail. But, had a time figuring out where Oath fit in. I found it awkward trying to login to gmail. First you have to attempt it at a low level Android prompt, then get notified that it requires browser based authentication to complete, since 2FA is involved. Frustrating to have to login again thru the browser, but OK, I log in AGAIN, then get prompted for the code. Do, I swipe the key, but the code isn't input automatically. You have to switch to the OATH app, get the code, but, after switching back to the browsr, you can't paste it into the verification window. You have to actually type it out, so I switched back to OATH, remembered the code, switched back to the browser, it had timed out. So, I had to repeat the Android login, then get forced back to login to the browser. Then, toggle to OATH, swipe, remember the code, toggle back, input it before the timeout. Made It! OK, A pain in the ass, but, lets what happens on a fresh boot of the phone. HUGE MISTAKE! This is where the nightmare truly crystalized. I spent a good half hour or more trying to login first to the Android prompt, forced to the browser, but before I could even bliink, some other process needed authenticating forcing away from the browser login, try to switch back, get part way in, another process needed authenticating forcing its prompt to the forefront! This went into s deep, maddening cycle! I never seriously wished to destroy an expensive device I owned until that very moment. I resisted throwing my phone out the window, cancelling prompt after prompt, until eventually I could get all the way thru the double login and switching back and forth from the browser to OATH. Truly a nightmarish scenario. I wouldn't wish that on anyone. OK. So, my phone is up, but God forbid I should ever have to reboot it again. I'm curious as to what the well meaning developers at Yubikey intend to do to somehow streamline this process. Clearly 2FA is the way to go, but this is a tremendous obstacle to overcome in making it appear as simple as some of the marketing material would have us believe.
|
Login
FAQ
Search
