Yubico Forum

Is it possible to replace the paypal security key with the yubikey in OATH-HOTP mode set for 6 digits?

I'm curious about this one, too...

Hi there,

very obiously it is not possible due to two facts:

1. it depends on paypal what backend they are using. So the question is, if they would support the yubikey, integrate and chip it.

2. Paypal uses verisign keys, which are not oath compliant but use some unknown 3DES algorithm to calculate the one time password

Kind regards
Cornelius

Since quite recently - yes you can.

http://www.yubico.com/vip

At present, the keys are sent out pre-configured so current keys cannot be updated with a valid VIP key. We'll see what the future will give us

Best regards,

JakobE
Hardware- and firmware guy @ Yubico

Only learned about it today...

So good to hear, that this is possible with a well defined algorithm...

What about the HMAC key - I guess it is transferred to symantec in a secure manner.
Would it be possible to also get the hmac key, so that one could use the OATH token also with other applications?

Kind regards
Cornelius

The HMAC key is proprietary to Symantec so that cannot be retreived.

However, the second configuration is open for your own needs so please feel free to assign your own HMAC key there to be used with other applications.

Best regards,

JakobE
Hardware- and firmware guy @ Yubico

Dear Jakob,

what does proprietary to symantec mean. Does Yubico generate the HMAC and ship it to symantec or is it vice versa?
Or does symantec generate the HMAC, store it to the yubikey and ship the yubikeys (via you?)
This would make sence - since I think they (former verisgn) are running the backend?

Kind regards
Cornelius

As the page at http://www.yubico.com/vip suggests, please do check with PayPal before purchasing one if you intend to tie it with PayPal.

Besides Denmark, APAC is not covered under PayPal VIP program according to PayPal Customer Service. It looks like only US, Canada, and limited European countries are under VIP coverage.

On the other hand eBay works with my VIP token from my APAC account, but then it is another device not Yubikey, so I can't be sure the VIP-enabled Yubikey works as well for Asian countries.

It will be great if PayPal supports VIP globally