Yeah, it confounds me why they didn't just use the open TOTP protocol. Google Authenticator isn't hard to use. And there are others if you don't want to use Google's. <span></span><br><br>On Sunday, October 4, 2015, Jeremy T. Bouse <<a href="mailto:Jeremy.Bouse@undergrid.net">Jeremy.Bouse@undergrid.net</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I've got an older Yubikey VIP that I believe the only thing I use it for is PayPal. For everything else I have my 2FA handled by using either Google Authenticator or Duo Security and I could honestly just move that down to Duo as it can handle both for me. Cost is nothing more than the smartphone/tablet I already own and always have handy nearby. If I site I use supports 2FA it's enabled immediately and used along with the long randomly generated password. Almost all of my servers with any outside public access require Duo 2FA to login and pretty much use SSH identity keys over v2 protocol to gain access.<br>
<br>
On 2015-10-04 01:14, DJ-Pfulio wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hope that nobody minds this ...<br>
<br>
Github and Yubico are pushing 2-Factor Authentication by making it VERY<br>
cheap. $5 for a device + shipping and handling. Limit 2; having 2 is a<br>
"best practice" to avoid issue if you loose one when traveling.<br>
<br>
The offer:<br>
<a href="https://www.yubico.com/github-special-offer/github-yubikey-special-offer/" target="_blank">https://www.yubico.com/github-special-offer/github-yubikey-special-offer/</a><br>
<br>
-------<br>
I ordered 2 - total cost was $15 including shipping.<br>
<br>
An unvalidated list of websites claiming support for the U2F protocol:<br>
<a href="http://www.dongleauth.info/" target="_blank">http://www.dongleauth.info/</a><br>
<br>
Only downside that I know is Google Chrome or Chromium browsers are<br>
required. Doesn't work with Firefox. There appears to be some udev setup<br>
required as well.<br>
<br>
Anyway - cheap protection against phishing and replay attacks for some<br>
online websites.<br>
_______________________________________________<br>
Ale mailing list<br>
<a>Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
</blockquote>
<br>
_______________________________________________<br>
Ale mailing list<br>
<a>Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
</blockquote><br><br>-- <br><div dir="ltr"><div><div dir="ltr"><div>James Sumners<br><a href="http://james.sumners.info/" target="_blank">http://james.sumners.info/</a> (technical profile)</div><div><a href="http://jrfom.com/" target="_blank">http://jrfom.com/</a> (personal site)</div><div><a href="http://haplo.bandcamp.com/" target="_blank">http://haplo.bandcamp.com/</a> (band page)</div></div></div></div><br>