Collaborate Disseminate
PIN-pad smartcard readers (class 2) for secure PIN entry exist, but I have only seen them for smartcards (that come in a card form factor) and they are both a PIN-pad and a card reader. Is there something analogous for USB security tokens … Continue reading Using USB Security Token with PIN-Pad for Secure PIN Entry [closed]
If you’ve used a corporate VPN or an online-banking system in the past fifteen years or so, chances are you’ve got a few of those little authenticator key fobs lying …read more Continue reading Generating Two-Factor Authentication Codes With a Commodore 64
I am looking for hardware TOTP system-on-chip, where it would not be possible for an adversary to extract the shared secret (TOTP seed in other words). I am researching an application, where one same seed has to be used in large number of … Continue reading Hardware TOTP system-on-chip with strongly guarded seed
I have an USB Token (brand 3SKey) containing a certificate "C" with its private key stuck on a machine "A". The certificate’s private key is obviously not exportable and I’m not interest into using 3rd party tools to tr… Continue reading Use a remote certificate (on other computer) for mTLS transaction
If I have a YubiKey/other hardware key, then I can add that as a U2F device and restrict logins to require that hardware key to be present when logging in to web sites with my username and password.
However, if I add "This Device"… Continue reading Chrome U2F Authentication TouchID vs YubiKey/Hardware token
[Samuel]’s first foray into making DIY hardware authentication tokens was a great success, but he soon realized that a device intended for everyday carry and use has a few different …read more Continue reading TurtleAuth DIY Security Token Gets (Re)designed for Durable, Everyday Use
As I understand, modern phishing is kind of like a man-in-the-middle attack. Let’s say, for example that User u has an account in Domain d where he has an SMS based 2FA enabled. This is what the phishing mechanism is like:
Attacker presen… Continue reading Is a hardware based 2FA more resistant to phishing than SMS or TOTP?
I was troubled from the very beginning by the fact that my U2F security fob acts as a keyboard and theoretically is able to press any key when no one is looking. Sometimes I accidentally touch it and then screen goes mad because of all tho… Continue reading Why do some FIDO security fobs use keyboard emulation mode?
I am trying to utilize the SafeNet eToken 5110CC, which basically has the IDPrime 940MD with the applet 4.4.2.A., to generate ECC keys with lengths 384bits and 521bits to no avail.
The product brief says that ECDSA and ECDH of 384/521bits … Continue reading SafeNet eToken 5110CC w/ IDPrime 940MD: Generating ECC384/521 Errors + ICC/CVC Authentication
Today I read this blog entry by Yubico regarding Asynchronous Remote Key Generation. This proposal solves, in my view, the largest outstanding problem in the widescale adoption of challenge-response hardware authentication keys.
Some backg… Continue reading Status of Asynchronous Remote Key Generation in the developing WebAuthn standard?