Add Yubikey OTP Support
Since PasswordSafe now supports Yubikey hardware for two-factor security it would be nice if pwSafe also supported this as well. Assuming the iPhone5 supports NFC then the YubiKey Neo could work with the iPhone5 and PasswordSafe to create a universal two-factor auth solution.
Ian Anderson
shared this idea
-
Eric Dutko
commented
Also, to make sure we're all on the same page, I'm interpreting Ian's suggestion as "make it possible to to work with YubiKey-protected safes in pwSafe on IOS." The stuff I'm working on does not have involve YubiKey's one-time password (OTP) functionality, but the OTP function is not currently used by Password Safe.
-
Eric Dutko
commented
So the iPhone 5 does not have NFC. But that doesn't mean those of us with YubiKey-secured password safes have to be stuck without a way to open them on our phones.
Assuming you're comfortable storing the YubiKey challenge-response secret on on your phone (encrypted of course), your phone could act like a YubiKey for pwSafe. This is theoretically less secure than keeping the secret in the YubiKey hardware, but it's no different than storing a backup of your YubiKey secret somewhere. For most people, I would expect that this tradeoff is worthwhile.
I recently completed a proof-of-concept Python script which takes a Password Safe password and a YubiKey secret and produces the data required to open a YubiKey-protected safe. My next step is to prototype this "emulated YubiKey" support in pwSafe. If someone on the pwSafe team is reading this, please let me know how I can submit this code for inclusion into the production version of pwSafe.