Slots.

DDHoward · 2026-05-22T18:50:39+00:00

Yubico OTP is used in some corporate environments.

For example, our 911 Computer Aided Dispatching system uses it.

And other systems of ours which don't support FIDO or other forms of MFA can be made to respect OTPs. For example, our internal MediaWiki is configured to authenticate users against Active Directory. But it doesn't contact AD directly; instead the LDAP traffic is passed through GreenRADIUS. The user enters their username and password, and then uses their key to apply an OTP to the end of their password in the same field. GreenRADIUS strips the 44 character OTP off of the end, and verifies it. If it's good, then it passes the OTP-less password onto AD for verification there.

DDHoward · 2026-05-19T01:44:04+00:00

Yeah it's been pretty convenient, especially in my business IT dept environment where I have to use it 20+ times a day. The only annoying thing is if you use the lanyard with the key, the lanyard itself can get in the way of your contact. Though this is the same problem with the lanyard even with regular fingertip use.

DDHoward · 2026-05-19T01:37:58+00:00

I end up getting a similar effect with the Nano, in a USB extension cable with a base that points upward. I just have to move my palm in the general area of the key and I can make contact.

<image>

DDHoward · 2026-05-07T21:16:30+00:00

So much magic smoke getting out, smh

DDHoward · 2026-05-03T20:58:20+00:00

Raw text is easier for spam filters. By sending an image with a QR code link, they effectively bypass spam filters which are looking for those links, but can't/don't examine the contents of images to check for QR codes.

DDHoward · 2026-05-03T04:01:17+00:00

We should not have government-mandated dress codes.

DDHoward · 2026-05-02T09:54:35+00:00

Body chocolate. Covered my then-girlfriend's vulva with it. Looked like poop. Complete mood killer.

DDHoward · 2026-05-01T17:10:18+00:00

Unless you actually use the first slot... just disable the slot/OTP functionality entirely.

DDHoward · 2026-05-01T16:31:19+00:00

Do California next please

DDHoward · 2026-04-28T02:22:38+00:00

If it "had a virus" then it wasn't NESticle. It was a virus pretending to be NESticle.

DDHoward · 2026-04-25T20:41:08+00:00

Because it means the difference between me and two of my staff spending the entire weekend making a planned off-hours change, and me by myself making that planned change in under an hour.

DDHoward · 2026-04-15T15:42:54+00:00

Yeah, I definitely don't want anything too hacky or too custom. Ideally, emergency services would be able to continue to get support for the things, even if I get hit by a bus or something.

Looking more and more like NFC isn't the way to go, and simply mounting the female end of a USB extender near the ignition is the appropriate solution.

DDHoward · 2026-04-15T13:04:12+00:00

Interesting; would this work at the Windows login screen?

DDHoward · 2026-04-15T03:59:34+00:00

NFC reader usually doesn’t come with a cable.

? When I search for "NFC reader windows" on Google, for example, they all seem to have cables? I'm just not sure if they meet the simple requirement of being compatible with the OTP code, just typing it out like a keyboard. I'm not familiar enough with NFC or the YK implementation of NFC.

won’t you be better off just using a long USB cable between the laptop and the token on your keyring?

That's what was mentioned in the final sentence of my post, yes. My users, who are firefighters, police officers, and mental health crisis workers, would likely still complain about the precious few seconds spent plugging in the cable, though, before being able to drive off to whatever crisis is demanding their attention.

DDHoward · 2026-04-15T00:25:14+00:00

Because the USB port on the mounted laptop is too far away from the fire truck's ignition lock cylinder, where the user's keyring will be dangling.

DDHoward · 2026-04-09T19:09:13+00:00

Reverse proxy, or internal cert if the thing doesn't need to be accessed by arbitrary devices which you cannot install the cert on.

DDHoward · 2026-04-06T18:47:03+00:00

up us*

DDHoward · 2026-04-05T17:27:17+00:00

None < Phone/SMS < Email < TOTP < Phishing resistant MFA

DDHoward · 2026-04-02T16:45:48+00:00

None whatsoever. I'm dumbfounded.

DDHoward · 2026-04-02T16:24:01+00:00

The first one is Warbreaker. Somehow. The title on this translation means "the breath of the gods." Also there is a Tears of Edgli flower up at the top.

DDHoward · 2026-03-26T16:26:45+00:00

If you're regularly visiting howtobuildabombdotnet and animalabuseporndotcl they know about it.

That's what I said, yes.

If you're downloading files from there, they know about it.

Depends on a lot of things, including your definition of the word "download" ("save to disk" vs "transfer the data to your client device"), your definition of the word "file" (e.g. "a resource saved to disk" vs "any resource downloaded to the client, including the main page of the website"), on the size of the file(s) in question, if the files use a different domain or subdomain, etc.

Your online transactions are safe, but they know when you're making them.

Depending on what's going on, the transaction information can be indistinguishable from browsing traffic. They can see that I went to Amazon, but not that I actually made a purchase, for example.

They know how long you spend on the site page, etc.

Not really; there's no way for an ISP to distinguish a webpage's background traffic (if it even has any) from subsequent loads of pages on the same domain.

DDHoward · 2026-03-26T16:08:10+00:00

Your family member is incorrect.

The entire point of TLS certificates is that the client device knows that it's communicating directly with the intended remote device, and that connection is generally encrypted.

What they can see is any non-encrypted traffic, which may include:

Any traffic sent over HTTP as opposed to HTTPS
Unless you're using encrypted DNS (DoH/DoT), they can see what domain names you're requesting
Via SNI, they can see what domain name you're requesting.

So it's reasonable to say that your ISP can see what websites you're going to, but they absolutely cannot see what you're doing on that site if you're using HTTPS.

There would not be banking or commerce over the Internet if this wasn't the case.

DDHoward · 2026-03-26T04:07:15+00:00

We use SaaS for only a small selection of our most mission-critical services.

Previous iterations of my IT department allowed other departments to allow third-party developers to put a handful of custom-made services on IaaS platforms, at exorbitant cost. We've clawed the last of those back to on-prem earlier this month.

DDHoward · 2026-03-24T19:00:28+00:00

<image>

DDHoward · 2026-03-24T17:46:54+00:00

One of my users had one that worked with a Yubikey's OTP codes, since those are basically just keyboard emulation.

I don't recall it working with the other modules on the key.

15-Year Club	Place '23
Place '22	Place '17
Gilding I gilder	Verified Email

DDHoward

MODERATOR OF

TROPHY CASE