This is a staging forum for AgileBits, not an official support forum. Visit http://discussions.agilebits.com instead.
Feature Request: YubiKey Support
Comments
-
I'd assume that you could implement a system like Rohos has (or is still trying to get done properly) using the SecurityAuthorization framework, if the Yubikey were to retain its "truly secure key". Or, assuming the agilekeychain uses its masterpass as part of the salt, having the unique OTP (uses modhex) be one half.
There was some work to get a login system done using a system like this (user's keychain is secured by a pw + the otp -- requiring both) in 10.5 but has not been updated, unfortunately.
Some ideas:
Even with the various wrappings of pks11 and other "CaC", a YubiKey is not a true pks#11 key, the key itself would require some serious hacking inside the pks stuff (trunk is on macosforge) to work, so this wouldn't be a quick bridge to getting it working.
It was quickly integrated into pam under linux, almost three years ago:
[url]http://code.google.com/p/yubico-pam/[/url]
(there is another variant that is designed for laptops/being offline)
Only issue that the work Apple did to get pam+et al integrated into securityauthorization normally makes building the source they have to keep open near impossible.Flag 0 -
I have to also jump n this bandwagon. I would love to use YubiKey with 1Password.Flag 0
-
Here you go, folks... no more excuses. <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/biggrin.gif' class='bbc_emoticon' alt=':D' />
Here is 100% complete code that I have running that implements YubiKey in a simple OSX app.
It includes validating the generated code with an AES key, checking for replays and even checking that the YubiKey clock is not too far out of sync with the computer clock.
You may want to add validating the YubiKey ID, I suppose.
I hereby grant Agile Web solutions to reuse or abuse the code.
File here: http://drop.io/yubimac
Others, feel free to download and mess with it. It does require you to reprogram your YubiKey with a new, private AES key.Flag 0 -
Thanks, Hoylen, for such an informative post!
Like Raymo, I initially learned about the Yubikey through Security Now. I recommend any security-conscious computer user [url="http://twit.tv/sn"]check it out[/url] (and I believe most 1Password users fit that description.)
While I, too, would love to see Yubikey support in 1Password, I can see why it might not be feasible. As I understand it, a Yubikey was not designed to be a local solution, where a fingerprint scanner would be more suitable. Unless you run your own validation server (which isn't a good solution for most end users,) the Yubikey authenticates the one time password with a database over the internet. While this is perfectly acceptable if I'm just using 1Password to log in to my bank's web site (since I necessarily have an internet connection available,) if I simply need to access account data in 1Password without an active internet connection and I'm using a Yubikey one time password that needs to be validated over the internet, I'm out of luck.
Yubikey is an excellent complement to a memorized password for multifactor authentication, but in most cases it isn't usable for strictly local validation. The strength of Yubikey is that -- due to its non-local validation -- the database is not vulnerable to a local brute-force attack. The host machine sends a query to a remote database validation server, and simply gets a response as to whether the OTP is valid or not. In order to validate without a remote connection, the database would have to be stored locally. To my mind, this would not be unlike the CSS keysets for [url="http://en.wikipedia.org/wiki/DeCSS"]decrypting DVD content[/url] being stored in the players in all of our living rooms in order to decode video for playback: given enough time and determination, anyone with direct access to secure data can break it. That said, if an untrusted party gains full access to your system, you likely have more pressing concerns; but I just thought I'd throw that out there.
Anyway, I'm sure that someone smarter than me will come up with a great solution to this problem. I love my Yubikey, but multifactor authentication of any kind would be a great security feature to add to what is already a robust product.Flag 0 -
Wow. A lot of activity here even as I was writing my last post.
Certainly, Yubikey static passwords are always an option, and could be much stronger than one you have to memorize, but that's kind of a step backward, I think. For, me the biggest hurdle in adopting the Yubikey as a second factor of authentication was that there are some services that I need to access from devices that aren't networked (e.g. my non-3G iPad) or that don't have USB ports (e.g. iPhones.) But I think it's safe to say that we're often left having to choose between security and convenience. Services that offer one time passwords sent in text messages allow us to use our phones as a second factor of authentication are great, but not terribly common.
I wish there were a good, all-around solution.Flag 0 -
[quote name='brenty (toromei)' timestamp='1284104819' post='10798']
Yubikey is an excellent complement to a memorized password for multifactor authentication, but in most cases it isn't usable for strictly local validation. The strength of Yubikey is that -- due to its non-local validation -- the database is not vulnerable to a local brute-force attack. The host machine sends a query to a remote database validation server, and simply gets a response as to whether the OTP is valid or not. In order to validate without a remote connection, the database would have to be stored locally. To my mind, this would not be unlike the CSS keysets for [url="http://en.wikipedia.org/wiki/DeCSS"]decrypting DVD content[/url] being stored in the players in all of our living rooms in order to decode video for playback: given enough time and determination, anyone with direct access to secure data can break it.
[/quote]
Agreed. I wish YubiKey made more sense in more places, but adding 1Password support just wouldn't seem to be that helpful. I was all ready to voice my full support for it, but am rethinking that a bit now. I love Security Now and all that Steve Gibson does for the security community (although he did recommend a competing password manager back in July <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/tongue.gif' class='bbc_emoticon' alt=':P' /> ), but I think even he would agree that it may cause more trouble than it's worth in 1Password.
Which sucks. Because I wanted to believe...
The hard part would be supporting iOS devices with YubiKey. We don't just make software for OS X, you know. <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/smile.gif' class='bbc_emoticon' alt=':)' />
(P.S. Welcome to the forums ehunt123 and JeremyLaurenson!)Flag 0 -
[quote name='khad' timestamp='1284251118' post='10898']
The hard part would be supporting iOS devices with YubiKey. We don't just make software for OS X, you know. <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/smile.gif' class='bbc_emoticon' alt=':)' />
[/quote]
That was a concern of mine, too, but the more I thought about it, the more I realized that it's less of a problem than it seems at first glance.
Sure, it isn't feasible to connect a Yubikey to an iPhone or iPad every time you need to authenticate (even though the [url="http://store.apple.com/us/product/MC531ZM/A"]Camera Kit[/url] would work, since the Yubikey functions as a USB keyboard.) If instead we ask, "What function does the Yubikey serve?" the answer, of course, is [url="http://en.wikipedia.org/wiki/Multi-factor_authentication"]multifactor authentication[/url]! (Sorry about the exclamation point, but multifactor authentication is just FUN.) So what we're really doing is using a password ("something you know,") along with a piece of hardware ("something you have") to authenticate ourselves. "Something you have," eh? Well, wait a minute...that's what our mobile devices are!
It certainly isn't as powerful as the Yubikey's one time password, but the pairing method 1Password uses (at least on the iPhone and iPad -- I don't have an android phone) is pretty impressive. Really, the biggest thing I'm missing out on by not using a Yubikey is the thrill of plugging in that adorable little dongle and pushing the button. The nice thing about 1Password (compared to, say, LastPass) is the ability to store literally everything securely without the need for an internet connection to retrieve it, which is a huge plus for things like personal data, and, for example, my router password to authenticate so that I can access my local network and the shared internet connection. <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/smile.gif' class='bbc_emoticon' alt=':)' />
That said, I think that Yubikey support in the desktop version of 1Password could still be a huge boon to users, keeping in mind the limitations; and, likewise, it wouldn't be necessary to support Yuibikeys in the mobile versions because the mobile device itself can be authenticated with the desktop app and serves as the "something you have" for multifactor authentication purposes.
Now we just need to figure out how to implement "something you are." <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/wink.gif' class='bbc_emoticon' alt=';)' />Flag 0 -
Awesome response, brenty. I can totally get behind this. Multi-factor authentication is already present in the mobile apps by the very fact that they run on "something you have." Cheers!
Stay tuned for the "something you are." We are working on some 1Password socks that will analyze your feet to authenticate you. They are mighty soft (and fuzzy). <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/skype_bigsmile.png' class='bbc_emoticon' alt=':-D' />Flag 0 -
I do not have a time frame for the authentication socks at this time, but you can find all [url="http://blog.agile.ws/"]the latest updates on our blog[/url] and even get the freshest socks news delivered right to your inbox by [url="http://agile.ws/company/newsletter"]subscribing to our newsletter[/url]. <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/laugh.gif' class='bbc_emoticon' alt=':lol:' />Flag 0
-
It would be very nice to have some kind of multifactor authentication. Have used the Yubikey with LastPass and they do not use the key for the iOS device. Have also used MyOpenID by JanRain. Here they call me and I have to respond by pressing the # key on my phone. This seems to me to be a very cool idea and easy to use. I agree and completely local authentication would not be possible with either of these systems. Maybe, in combination with a one time password for those times when the Internet is not available?Flag 0
-
Can I tip my hat towards this request as well? Yubico's Yubikey OTP (One Time Password) would be a great addition to the 1Password ecosystem of apps for Mac and Windows. This is one those features the Virginia team working on the LastPass.com service implemented early on. Very useful indeed.
It only makes sense to use multifactor authentication when a user is putting all of their eggs (i.e. passwords) in one basket (i.e. software). The basket should be protected with something you know (i.e. a password that is somehow known and entered into the computer) and with something you have (i.e. a one time password system or token like the Yubikey).
A Yubikey might look like a small- and perhaps typical- USB drive... but it isn't a drive, it is a device with a specific purpose. A Yubikey is somewhat similar to SafeNet's eToken PRO Anywhere USB device in that it provides a mechanism for One Time Passwords using a third party service. Unlike SafeNet's eToken PRO Anywhere, Yubico's Yubikey USB device doesn't need special drivers installed on the Mac or Windows. It works on every computer because the Yubikey is really a fancy keyboard in a small- tiny really- form factor that talks to a server to get a One Time Password.
When 1Password and Agile's future products support Yubico's Yubikey, the software will not allow a user to see the contents of 1Password's database unless a user types in a mentally memorized password that doesn't automatically change, and presses the button on the Yubikey (while connected to the computer of course) to provide a one time use password that always changes automatically.
If Agile hasn't done this already, I'd say have someone from the staff get a Yubikey and a LastPass.com Premium account so they can try what an integrated Yubikey password system looks and feels like. Knowing the folks and products in Agile, I'm sure the Yubikey integration Agile will come up with will have an ease, flair, and style that only Agile can conjure up. 1Password is brilliant in its presentation and ease of use. The Yubikey OTP USB device will fit right in.
[quote name='khad' timestamp='1287868075' post='13930']
Multi-factor authentication is already present in the mobile apps by the very fact that they run on "something you have."
[/quote]
Huh? I'm not sure khad understands the concept of something you have. Either that or he accidentally gave a different impression by wording the sentence like this. I was initially a little concerned to see someone on Agile's Customer Care staff get this wrong since Agile makes the important 1Password software product. Anyone can make mistakes though. No worries.
Something you have refers to the way a user authenticates (i.e. provides credentials like username, password, and token) to the software or service. It does not have anything to do with where you run that software from. In other words, just because it is possible to run 1Password from a USB drive, it doesn't mean you have multifactor authentication.
I'm a big fan of 1Password for Mac and Windows by the way. Knox rocks your socks too. Go Agile! You guys blew my socks off Thanksgiving 2010 by letting me freely gift apps I already held dear, used regularly, taught and showed others consistently. I got to send 1Password and Knox gifts to my family. If I wasn't on the opposite coast I'd visit and awkwardly hug Dave Teare or the person(s) responsible. This is how you guys win fanatical customers.Flag 0 -
Thanks for the very kind words, getraf, and welcome to both you and Slobodan for joining our forums! We appreciate knowing that the posters on this thread each see some value in this approach.
We're keeping an open mind, but just to set the proper expectations: this is not something that's being actively worked on at this time. As Khad said, stay tuned to our normal announcement channels should there be any developments (hehe) in this area.Flag 0 -
[quote name='MartyS' timestamp='1292375891' post='17614']
Thanks for the very kind words, getraf, and welcome to both you and Slobodan for joining our forums! We appreciate knowing that the posters on this thread each see some value in this approach.
We're keeping an open mind, but just to set the proper expectations: this is not something that's being actively worked on at this time. As Khad said, stay tuned to our normal announcement channels should there be any developments (hehe) in this area.
[/quote]
The newer versions of the yubikey hardware/firmware (2.2+) now support an HMAC-SHA1 mode that can be queried through normal USB HID apis (though they require an admin account to access and password verification on use, at least on OSX). Basically you spit a 64byte challenge to the the device and it spits back a response using HMAC-SHA1 with the set key which is not retrievable from the device.
The upside of this is that 1Password could use this same mechanism on both the iOS/Android versions and the OSX/Windows versions, since HMAC-SHA1 is trivial to implement in software. (iOS Framework even provides it already.) Since, as pointed out above, the physical device in the case of a phone/etc *is* the second factor of "something you have" I think this would be a nice improvement.
It could even be done in a way that each device (yubikey, ipod, android device, etc) had a different HMAC key and 1Password wouldn't ever actually need to know the HMAC keying material.
For example:
1. Don't use the actual master password as the source material for your key derivation function.
2. Use a real random 128/256bit key and don't pass it through a derivation function at all.
3. Split the key using Shamir's secret sharing algorithm in a way where 2 shares are necessary for recombination and there are as many shares as HMAC-SHA1 sources + 1 for the master password.
4. Encrypt one share with the master password as source for the key derivation function.
5. Encrypt each additional share with the response from it's corresponding HMAC source as the source material for the key derivation function.
6. Store each challenge for each HMAC source encrypted the same way as the master password share so that the master password is required before the challenges can even be found. (This prevents the loss of two devices immediately compromising the system assuming a strong password.)
7. Every time a given non-password share is used, re-encrypt it using a new challenge.
This gives you semi-one-time password support and opens up your design to allow fairly trivial addition for an endless number of factors for auth.
The UI for adding devices could be challenging to get right since each time you add a device you will need to decrypt the real key then split it back out which will require querying all of the HMAC sources at that time; however, the back-end portion is pretty straight forward.Flag 0 -
Please count my voice as one more asking/pleading/begging for Yubikey support.
I know you don't want to hear this, but I switched from 1Password to Lastpass.com because of its Yubikey support. I'd rather use 1Password, but without Yubikey...
Look, everyone knows Yubikey is not perfect. But multi factor authentication is important for some of us, including those of us with laptops.
Don't get distracted by the "we can't use Yubikey on an iOS device." Lastpass doesn't either. But if you added this functionality into the regular OS X and even Windows platforms, you'd make a lot of people happy. You might even get some folks like me back in the fold. <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/wink.gif' class='bbc_emoticon' alt=';)' />Flag 0 -
Voice counted, Bill, and I'm sorry to hear MFA / YubiKey support is a deal breaker for you.
As we've mentioned, YubiKey support isn't something we're actively working on or investigating at the moment, but that doesn't mean it won't be something we can look into for the future, but we're not going to lie and say 'we're working on it' when we're not.
Thanks for the vote,Flag 0 -
Hi,
I'd also like to voice interest in Yubikey support. As I understand it, there are two methods to implement yubikey support, one of which is already basically supported by 1Password already:
1) yubikey in static password mode
2) yubikey in one time password (OTP) mode
YubiKey generates a 44 character long password every time, when the button is pressed. The 44 character password contains the following information:
The first 12 characters represent the ID of the YubiKey. Rest 32 characters represent the password (typically One Time Password).
YubiKey can be operated in one of the following two modes depending on the user requirement:
[b]1) One Time Password Mode:[/b]
In the One Time Password (OTP) mode, every time when the user presses the button, YubiKey generates a 44 character long password which contains a static “YubiKey ID” and an event based “One Time Password”.
For Example:
Observe the following OTPs generated from a YubiKey configured in “One Time Password Mode”
fuhkifhkhufbfdccgukghlbuinldkcndkrrluvedbthrhi
fuhkifhkhufbfdvblbbleffckfhthjdgrgjrbtjbnnlhdl
fuhkifhkhufbfdhgghncdchnkhrribnukccgurhtlgkfuf
fuhkifhkhufbfdfcicntcjjdjgchdgifgjebgrenugrfuk
fuhkifhkhufbfdcrtefbtnnebvtuvhdthbrltvckergedl
Here the first 12 characters (representing the YubiKey ID) of all the OTP are same. The next 32 characters (representing the One Time Password) are all different and generated based on event based OTP generation scheme of Yubico, thus resulting in a unique 44 character long password every time. This is the default mode of YubiKey.
[b]2) Static Password Mode:[/b]
In the Static Password mode, every time when user presses the button, YubiKey generates a 44 character long password which contains static “YubiKey ID” and a static Password.
For Example:
Observe the following passwords generated from YubiKey configured in “Static Password Mode”
fuhkifhkhunjfkjeegdcherbljkrdgvhhkllicgcuu
fuhkifhkhunjfkjeegdcherbljkrdgvhhkllicgcuu
fuhkifhkhunjfkjeegdcherbljkrdgvhhkllicgcuu
fuhkifhkhunjfkjeegdcherbljkrdgvhhkllicgcuu
fuhkifhkhunjfkjeegdcherbljkrdgvhhkllicgcuu
Here the first 12 characters (representing the YubiKey ID) and the next 32 characters (representing the One Time Password) are randomly generated at the time of programming the key and always same when the button is pressed, thus resulting in a same 44 character strong password every time.
To validate the OTP generated by YubiKey (in “One Time Password Mode”), the OTP needs to be sent to Yubico Validation Server (or a locally hosted validation server). The Yubico Validation Server validates the OTP and if it is valid, provides “OK” status or else provides a negative status response.
As the OTP generated by YubiKey (in “Static Password mode”) is always the same, there is no need to validate it against Yubico Validation Server. The password can be used as a conventional but strong password. This password is 44 characters long.
One method to use the yubikey with 1Password, especially if there is no internet connection available, would be to configure the YubiKey from "One Time Password" mode to "Static Password" mode.
Yubico provides a personalization tool that can be used to configure YubiKey from “One Time Password” mode to “Static Password Mode”. Use this utility to configure the YubiKey to produce a fixed (randomized at the time of programming) password which you can use with the router. Please note that the Static password can not be defined by user. It is selected by YubiKey randomly, when it is changed from “One Time Password” mode to “Static Password” mode.
To use YubiKey to authenticate with 1Password, follow the steps below:[list]
[*]1) Configure your YubiKey from “One Time Password” mode to “Static Password” mode as explained above
[*]2) Set your password for 1Password as the static password generated from YubiKey
[/list]
-----
This method will save us from having to "type" in the static password to unlock 1Password. This password (44 characters) is probably much stronger than the password you are currently using, and even if your current password is at least 44 characters long, it will save you from having to exercise your fingers so much. The downsides of this method are that
1) because the static password is randomly generated, it is not likely something you can remember easily, necessitating you to have your yubikey present to unlock 1Password.
2) should you lose your yubikey, because you cannot remember the unlock password, you are now S.O.L. for remembering your other passwords.
For those who wish for the additional security of multifactor authentication (something you have) via the YubiKey or the coolness of One Time Passwords, there would need to be an internet connection on your computer that verifies the OTP with the Yubico server.
One downside to this is that the local computer needs to have internet connection to verify the password. I'm not sure if the communication between this server and your local computer can be spoofed to give a valid response, especially given that a local computer could be a laptop connected to the internet via an unsecure wireless connection. Many of the services that use the OTP feature of the Yubikey are on hosted machines that a hacker has no access to, preventing a man-in-the-middle attack. One way around this is if a local instance of Yubico's authentication server is running on the local machine, also solving the problem of requirement for internet connection. The downside to this is that it is probably not easily implemented by AgileBits and would require a dedicated 'push' to implement, which is not something they are focused on at the moment.
What would be nice is a compromise. I would like to see 1password be able to be unlocked via a SECOND password.
The first password that would unlock 1Password would be the current one we are using - something you know.
The second password that could unlock 1Password would be the static password of the YubiKey. 1Password would check the entered password against BOTH of these answers and if the entered password matches EITHER of these two answers 1Password would unlock for use.
The upshot to this is that you can verify yourself with something you have (YubiKey), quickly and easily, without fear of keyloggers or the annoyance of typing in your strong (read: long) password. And should you lose that YubiKey or not have it on your person when you wish to use 1Password you can still log in via your regular password.
This solution would NOT be that difficult to implement, it would simply require adding an additional password to check against.
Thoughts?Flag 0 -
Welcome to the forums, Fredvs79! Thanks for [url="http://forum.yubico.com/viewtopic.php?p=855&sid=29157ef5e245da471b214cd3f6df14d6#p855"]reposting[/url] that.
Having two passwords actually decreases security if one is weaker than the other. If either one works to unlock your data, the security is reduced to the lowest common denominator. If I have two passwords, "a" and "CDFcrBDyFoju2geRxNytnpmoUGBbHKVDty7RKBptZqWiZnEmGT" but both will grant you access to my data, my data is only as secure as the "a" password.
We continue to evaluate the MFA landscape, but I don't have anything to announce at this time.
If we can be further assistance, please let us know. <img src='http://forum.agilebits.com/public/style_emoticons/<#EMO_DIR#>/skype_smile.png' class='bbc_emoticon' alt=':-)' />
Cheers,Flag 0 -
Thanks Khad. You are quite astute to note that [i]part[/i] of my post was written elsewhere on a different forum almost 3 years ago, but which everyone here in this discussion has failed to make mention of.
I would like to point out that you have unfortunately seemingly missed the point of my post. While I agree that when two passwords are capable of unlocking 1Password, I would not compare the randomly generated 44 character password to the letter "a". That is a horrid analogy, and completely outside the reasonable realm of comparison. How many characters is your "strong" password that you enter every time you unlock 1Password? If it is less than the 44 character password that is randomly generated by the yubikey in static mode, then as per your your example case, your "strong" password would probably be more like the example of the letter "a". Therefore you are not weakening security by adding yubikey support.
If your unlock password is longer than 44 characters, congratulations, I'm sure it isn't TOO much of a burden to type that in EVERY time you wish to unlock 1password, which could be several times an hour depending on how configure 1Password. And have you considered that if you make a mistake typing in your longer-than-44-character-password, you have to type it in again? Plugging in a yubikey would be a lot easier.
In summation, with two passwords, the security is only as strong as the weaker password. But by adding yubikey support, I don't believe you are weakening security, as the yubikey password is in all likelihood stronger than your regular password.Flag 0 -
Hi everyone,
There is a lot to say in favor of multi-factor authentication (MFA) and Yubikey specifically. Many of you have done a great job saying this.
I personally keep going back and forth between wanting us to move toward MFA and wanting to stay clear of it. So I find looking at this discussion very useful.
As has been mentioned, we would need a solution that works across all platforms, and most importantly does not let the second factor travel through the syncing mechanism. This isn't insurmountable, and internally we've been kicking around some ideas that might do the trick. Though we have to be careful about how backups and such work.
One thing that we need to keep in mind is that the number of times that people have had their data stolen (through having their computers stolen) is tiny compared to the number of cases where people have forgotten their master passwords. So given the kinds of threats that are actually out there, I can see something like this harming far more users than it would help. If the second factor is lost or damaged somehow, you lose access to hundreds of your passwords. [url="http://blog.agilebits.com/2011/04/keeping-your-data-at-your-finger-tips-part-i/"]Data Availability[/url] is a part of data security that people often overlook.
Another point against introducing MFA is more generally covered in the section on feature bloat in
[url="http://blog.agilebits.com/2011/08/convenience-is-security/"]http://blog.agilebit...ce-is-security/[/url]
And there is one more point to consider. 1Password stores your data on your local machine (and, if you sync, on Dropbox). But there are other systems where the data is stored remotely and the same password that is used to unlock your data is also used to log into the system. With such systems, a username and password is all that is needed to get at all of your passwords. With those systems, having a second factor for authentication is more important for security.
With 1Password, your 1Password encrypted data also needs to be captured. This does, of course, happen sometime when a computer is stolen or if there is a Dropbox breach. So it wouldn't be correct for me to say that your 1Password data file acts as a second factor. It's not protected to the same extent that you would protect a second factor. But without too much of a stretch, I think that we could almost get away with saying that 1Password uses one and a half factor authentication.
I'm not trying to say that we won't do this. I have been looking at the technical requirements needed, and have been thinking about this a great deal. But I want to be as open as possible about why I am less enthusiastic about two factor authentication than many of the people posting here.
But your enthusiasm is an important factor (the pun was purely accidental). So please continue with the great discussion and ideas here.
Cheers,
-jFlag 0 -
Add me to those wanting Yubikey integration. maybe just make it an option for those that want it.Flag 0
-
The biggest reason I need MFA is that I use my password repository (which, for the time being is a major competitor of yours) from my work desktop. I don't want my employer having access to my entire password repository simply because I needed to login to some random website using a password from my password repository. For that matter, I don't want them to have access to *any* of my stored passwords. It's the whole reason I use the autofill/autocomplete functionality.
Right now, with the use of a Yubikey, my information is protected even if someone has installed a keylogger on my machine. Yes, they'd have access to my local 1Password repository via my local Dropbox copy but at least they wouldn't be able to immediately access any of my stored 1Password information the moment I step away -- assuming I take the Yubikey with me. <img src='http://forum.agilebits.com/public/style_emoticons/<#EMO_DIR#>/wink.png' class='bbc_emoticon' alt=';)' />Flag 0
![[Deleted User]](https://wd.vanillicon.com/v2/d67898e43981d615d2bad887d3056ef6.svg)
