Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 7:57 pm

All times are UTC + 1 hour




Post new topic Reply to topic  [ 2 posts ] 
Author Message
 Post subject: Static Password Settings
PostPosted: Sat Sep 01, 2012 12:49 am 
Offline

Joined: Wed Jul 04, 2012 5:12 pm
Posts: 4
Location: United Kingdom
Hi,

I have just been looking at my YubiKey personalisation program on my Mac and come across a part in the settings titled 'Static Password Settings'. Under the title there is a tick box with 'Enable manual update using the button (YubiKey 2)'

What does this mean/do?

Thank you,
Sam


Top
 Profile  
Reply with quote  

Share On:

Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

PostPosted: Mon Sep 03, 2012 11:27 am 
Offline
Yubico Team
Yubico Team

Joined: Mon Feb 22, 2010 9:49 am
Posts: 183
Hello,

In order to support legacy password systems, the Yubikey 2 supports user-triggered static password change. The function is designed for the specific use case of a traditional login system with a stricter password policy where the user is asked to change their password on a regular basis.

The intended use case is like the following:
1. The user is asked to update their password.
2. The user enters their secret password. The user presses the Yubikey button and the current fixed password is yielded
3. The user is asked to enter the new password.
4. The user enters their secret password. The user presses and holds the Yubikey button for 10 seconds.
5. When released, a short tap updates the internal password with a new randomized one. The new OTP is sent.
6. The user is asked to confirm the new password.
7. The user enters their secret password. The user presses the Yubikey button again and the new password is sent.
8. The user completes the password change.

As the change function has no protection against unauthorized usage, there is a danger that an unauthorized person can sabotage a user’s Yubikey by triggering this function.

Thanks and best regards,
Samir.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 2 posts ] 

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 5 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group