Hacker News Reader

Comment by tptacek | Hacker News Reader

Annoying nerd pedantry: It's only sort of doing TOTP (Yubikeys don't have batteries, so need a software client to provide the clock), and on a slack with almost 300 crypto nerds in it, I don't know any of them that use the Y4 for TOTP (I'm preparing myself to be surprised in a minute when someone there reads this). TOTP is something you do on your phone.

View on HN

I only do TOTP on my phone. The Yubi Authenticator app is a drop-in replacement for Google Authenticator, but it adds significant security because the keys are stored offline in the yubikey and the crypto is done in the fob. Your phone is relegated to sending the time and displaying the OTP, which greatly reduces the attack surface of a standard OTP app.

The actual usage is exactly the same as Google Authenticator with 1 more step (NFC with NEO or plugging in the yubikey 4) to get the OTP.

In addition to what the others have said, I would point out that TOTP with the Yubikey/Yubico Authenticator has one other advantage. You can move between different android devices without problem. Its even nicer then Cloud-based Authy.

I was in a pinch once and had to do TOTP, so I grabbed the phone of my friend, downloaded the app and used it to log in.

TOTP with Yubikeys is great. You just need the Yubico Authenticator app to access the TOTPs. Works fine on phone using NFC as well as on my (Linux) desktop using USB. New phone? Install YK Authenticator, tap the YK and use your TOTPs.

How do you do TOTP on linux with your Yubikey? I keep using my phone.

Yubico Authenticator for Desktop:

https://www.yubico.com/support/knowledge-base/categories/art...

If you're on Ubuntu you can use the package yubioath-desktop from this PPA:

https://launchpad.net/~yubico/+archive/ubuntu/stable

Reply on news.ycombinator.com