Update: I will be putting together a HOW-TO for using the YubiKey to lockdown access to many popular websites. Stay Tuned!
New Years resolutions are tough and difficult, but here is one that you can keep: Secure Your Digital Life!. It seems like every day we read a news story about a corporation getting hacked, private details leaked, credit cards stolen. This New Years, resolve to lock down access to your online information, starting with your account access.
The password is dead, long live the password!
How hard do you think it is for someone to guess your password? Is it your mothers maiden name, or perhaps your drivers license? How long do you think it takes for a computer to try to brute force your password? Hint: Not long. The password is dead, long live the password! Well, almost. We need more than just a password, and most sites (Gmail, Facebook, etc) support 2 Factor Authentication. With 2Auth, a password is not enough, you also need to provide a time sensitive token, usually generated by your phone or key fob.
You may have seen this already, in fact, you may have Google Authenticator or Duo already installed on your phone, and thats great! Its definitely a step in the right direction… but did you know the secret keys stored on your phone are accessible to just about anyone? Yup. Those apps are storing the secret keys for deriving your login tokens right on your phone’s storage. They are there for anyone to see.
That’s where hardware comes in, which is harder to crack (but not impossible). Data can be stored in WRITE-ONLY areas, meaning that attackers will have a difficult time getting at the secret keys used to generate your login information. My favorite device so far is the YubiKey, which can do just about anything. From OTP to U2F (2 Factor Authentication), this little key does it all (including GPG keys). It even has native support for Gmail (and Google Apps).
The Two Factor Auth List has a list of popular websites that support 2 Factor Authentication. Most sites that support a hardware or software implementation will be compatible with the YubiKey, including the popular LastPass Password Manager.