Quote:
I'm not from yubico, but I read and don't understand your concerns exactly. They check in repo changes as they are made.. I don't think that the source code repository is intended as a product of commercial quality, but rather a tool for the community.
I could be wrong.
The Yubico public validation server runs off the key subsystem code in the public repository. The changes to the source that concerned me were made by a Yubico employee.
It's not unreasonable to expect the proper handling of tokens and OTPs in source that is created by the company selling the tokens. It's pretty hard to imagine any other token vendor exposing such borderline cavalier behavior to code correctness.
If you don't understand why the way Yubico deals with this bug -- its initial introduction by quick-and-dirty untested code changes and its subsequent attempt to fix by equally untested code change and complete silence on these facts when challenged -- is very dangerous, then I'm sorry but you don't understand enough about security and should be looking for a different solution.
Unless the Yubikey is just a toy, in which case shame on me for thinking otherwise.
Login
FAQ
Search
