Questions tagged [hardware-token]
The hardware-token tag has no summary.
38 questions
1
vote
1
answer
278
views
Why do some services require a hardware-based passkey and others allow a software-based one?
I use Bitwarden for password management, and it also manages passkeys, if so desired. When logging into my Google account, the creation and retrieval of my passkey is seamless, it was securely stored ...
- 113
3
votes
1
answer
2k
views
When is FIPS certification important?
I was looking at YubiKeys and noticed that they sell FIPS certified keys alongside non-FIPS certified keys. Both seem to have the same feature sets, but the FIPS certified keys are more expensive. ...
- 195
2
votes
2
answers
269
views
Can Fido2 hardware tokens be used for key agreement or Diffie-Hellman?
With Fido2 becoming more popular we see more and more affordable Fido2 hardware security keys on the market.
Can we use those tokens also for establishing a shared secret between two tokens?
I would ...
0
votes
0
answers
154
views
Passwordless authentication using expiring hardware keys
I am looking for a solution to implement passwordless authentication using expirable hardware keys. It is for devices around the world with Windows OS, and sometimes service technicians have to do ...
- 101
1
vote
1
answer
2k
views
How are hardware keys phishing resistant to man-in-the-middle attacks?
I've heard that hardware keys like Yubikey are phishing resistant. But I do not understand where a phished man-in-the-middle attack, which tries to "forward" the whole communication, fails ...
- 157
1
vote
0
answers
190
views
Hardware TOTP system-on-chip with strongly guarded seed
I am looking for hardware TOTP system-on-chip, where it would not be possible for an adversary to extract the shared secret (TOTP seed in other words). I am researching an application, where one same ...
- 111
0
votes
0
answers
156
views
Use a remote certificate (on other computer) for mTLS transaction
I have an USB Token (brand 3SKey) containing a certificate "C" with its private key stuck on a machine "A". The certificate's private key is obviously not exportable and I'm not ...
- 143
3
votes
3
answers
2k
views
Is a hardware based 2FA more resistant to phishing than SMS or TOTP?
As I understand, modern phishing is kind of like a man-in-the-middle attack. Let's say, for example that User u has an account in Domain d where he has an SMS based 2FA enabled. This is what the ...
20
votes
5
answers
4k
views
Why do some FIDO security fobs use keyboard emulation mode?
I was troubled from the very beginning by the fact that my U2F security fob acts as a keyboard and theoretically is able to press any key when no one is looking. Sometimes I accidentally touch it and ...
- 301
3
votes
1
answer
1k
views
SafeNet eToken 5110CC w/ IDPrime 940MD: Generating ECC384/521 Errors + ICC/CVC Authentication
I am trying to utilize the SafeNet eToken 5110CC, which basically has the IDPrime 940MD with the applet 4.4.2.A., to generate ECC keys with lengths 384bits and 521bits to no avail.
The product brief ...
- 583
0
votes
1
answer
163
views
Protect server-side key with client token
I'd like to encrypt some data on the server using a user-managed secret. I could just ask for a password and derive a key from that, but ideally I'd like to offer users the option of using a yubikey ...
- 123
1
vote
2
answers
373
views
Pre-paired hardware security tokens - Why don't they exist?
I've had this idea bouncing around in my head for a while, and I'm honestly surprised that it doesn't seem to be on the market. Which probably means that it wouldn't work well for some reason that ...
- 520
1
vote
3
answers
420
views
Are hardware tokens secure in case of a data breach?
One of my banks authenticate me using username and an one time passcode (8 numbers) generated by a hardware token they gave to me when I opened the account.
On the surface it looks like that as long ...
- 1,985
2
votes
2
answers
401
views
use custom 'key' for hardware security token
Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (...
- 131
0
votes
1
answer
322
views
synchronization of keyfob token generator
At work, years ago, I used to have a key-fob device that was about the size of a thumb-drive. It had a 4 digit LCD screen that the numbers changed every 60 seconds. When logging onto certain servers,...
- 159