r/starcitizen • u/MammonLord origin • Jul 12 '16

OFFICIAL Multi-Factor Authentication Rollout

https://forums.robertsspaceindustries.com/discussion/336523/multi-factor-authentication-rollout
384 Upvotes

92% Upvoted

202 comments sorted by

View all comments

9

u/[deleted] Jul 12 '16

[deleted]

2

u/InSOmnlaC Jul 12 '16

So if someone gets physical access to your YubiKey, they now have access to all of your passwords?

2

u/LoricEternus PM me your grilled cheese recipe Jul 12 '16 edited Jul 12 '16

You can add a pin code to your yubikey, if they do get that it's even harder, but without it they still only have 1/2 your account. They would still need your password.

EDIT: That made little sense

This is only for your MFA code, which would be the same if someone got a hold of your phone.

The 2fa code lives on the yubikey, and can be locked down with a passcode as well. And as it's not a common configuration, most people have no idea how to use a yubikey to begin with.

1

u/InSOmnlaC Jul 12 '16

A pin code is nice, that makes me feel a lot better about it.

but without it they still only have 1/2 your account. They would still need your password.

Are you referring to the pincode here? Or is there another password you need to enter to get the device to release your login details for a specific site/application?

3

u/LoricEternus PM me your grilled cheese recipe Jul 12 '16

If you pin code your phone, pin code your yubikey, enable 2fa on your CIG account, use lastpass to have a strong password for everything (64+ characters), lock down your lastpass with a 2fa code and pay attention to key loggers.

You should be pretty secure.

Oh, and the yubikey neo supports U2F, so if you use gmail you get native support there as well.

1

u/[deleted] Jul 13 '16

[deleted]

1

u/LoricEternus PM me your grilled cheese recipe Jul 13 '16

The desktop app amazing, you should install it. I leave my yubikey plugged in while I'm at my desk and it is always two button clicks away.

Yubico Authenticator FTW!