I have now upgraded the blog to use two factor authentication for logins to the WordPress back end. Meaning, to login you have to present something you know (username/password – ho hum) and either something you have (keyfiles / SSL client certificate / one time password (OTP)) or something you are (biometrics like finger prints, iris scan, hand scan, etc). This solves a whole host of authentication problems when you only use one factor. It’s certainly not the end all, but if implemented correctly it definitely increases security to add a second (or third) factor.
Now typically the second factor authenticators pose a few problems. First being, I’m not an enterprise and most second factor authenticators are the realm of enterprises. Companies selling these solutions (RSA SecurID, Verisign VIP, and the like) charge a lot of money for proprietary software licenses and hardware tokens. Most biometric devices worth having aren’t portable or cheap.
The other problem you have with a lot of these solutions is the fact that they are VERY proprietary. RSA is not going to just let you take a perusal of their source code. Sure, we have a general idea about the algorithms and the technologies these companies employ, but we know nothing of their exact implementation. That’s fine if you can trust RSA and you or the developers you buy software from can integrate RADIUS or whatever API or protocol that these solutions require. And not to pick on RSA here, there’s a lot of other hardware OTP token providers out there.
Needless to say, a less expensive, more open source and portable solution was what I wanted for my personal use. It’s something I’ve been looking into for a awhile. Years ago I was very thrilled at the idea of being my own OpenID provider with backend authentication being performed with an OTP like SecurID. Of course, it wasn’t then something that was possible to do on a small, individual scale. In fact, I bemoaned this rather depressing fact on episode 95 of the Security Now podcast back in 2007.
However, the other day I finally decided to check out a solution to this sticky little problem. It’s been around for a little while, but I think their version 2 product is refined a bit that it’s now at a point where I can consider it secure. Also, there’s now enough open source people working on authentication modules and the like for it.
Yubikey, photo by Thomas Flenstad
The product I’m talking about is the Yubikey from Yubico. It’s actually a rather ingenious little product. It’s basically a tiny USB device that contains only a small capacitive button. There’s no display, drivers, client software, or the like. Rather, it’s a USB HID device…like a keyboard! See where they are going with this yet? All you do to generate and use an OTP is touch the button on the Yubikey. That’s it! The Yubikey spits out a fresh 128-bit blob right into the machine it’s plugged into just by sending out keyboard scan codes via USB, like any keyboard would do. For the lazy people reading (*ahem*) this is even better than SecurID because it types the code for you! It even sends the enter key afterwards to finish submitting your authentication form or dialog box for you. Talk about easy!
There’s some cool technical details to read about at their site or you can listen to Security Now episode 145. But basically, I’m really loving the Yubikey model. It’s inexpensive, platform independent, and not proprietary in the least. You or anyone can implement their own Yubikey authentication, including offline authentication (useful for internal / private applications).
As I’ve said, I’ve rolled out Yubikey for my WordPress installation. I’m excited to continue the roll out into other areas such as OpenID and SSH authentication. Yubikey is affordable OTP / two factor authentication for the rest of us.
