About this question
How do YubiKeys work? Are there any alternatives?
How do YubiKeys work? Are there any alternatives?
Log in to share your answer and help other learners.
Log in to answerBest Answer · By JanBask Cyber Security Expert
Answered on Mar 1, 2022
As I understand it, the answer to your question - how does Yubikey work is that Yubikey acts like a USB keyboard. You plug it in your computer, place the cursor in a form field, press the button on the Yubikey, and it sends out a text string of 44 characters to the computer like you are typing those 44 characters. The computer doesn't know the difference between you typing it or the Yubikey generating it. A website like a Wordpress site with Yubikey plugin, or the Lastpass addon in Firefox, or any other website that has a Yubikey option, has a login form with username, password, and Yubikey password. You enter your username and password, place the cursor in the Yubikey field, then press the Yubikey button, and it enters the Yubikey password into the field.
Then the form is submitted, and the Yubikey is validated in the Yubicloud. The website checks if the entered Yubikey password is valid. The Yubikey itself does not connect to the Yubicloud. It's just a device generating a string sending it out acting like a keyboard, and it does not connect to the internet or anything except as that keyboard. Before all this works, you need to update your account on the website to use Yubikey. That means you need to link your key to the account. That way the Yubicloud can check the generated code and validate it against your account.
The website of course needs to implement the Yubikey functionality, which is available as a free service for website owners. If the Yubikey gets lost, you can use the normal recovery methods the website has to recover your account and disable the Yubikey. Normally this means that you get a password recovery link via email, and that link disables the Yubikey function in your account. I mailed Yubikey support to see if this answer is correct. They said this explanation was correct, except that it explained only one part of the way the key works. The other answers here don't give any real explanation. Even the Linuxjournal article doesn't explain it this way. The accepted answer gives a black-box answer - not what I was looking for when I opened this page. I hope this answer gives a better explanation and writing it made me understand the Yubikey better.
Free tutorials and interview questions from industry experts — learn the skill, then get ready to prove it.
Step-by-step Cyber Security guides from industry experts
Common Cyber Security interview questions, answered
Guides, tips and career advice on Cyber Security from JanBask experts.
Cyber Security Ethical Hacker Roles and Responsibilities: What Do Ethical Hackers Actually Do?
What does an ethical hacker actually do? See the five-phase process, daily tasks, required skills, and where ethical hackers work.
Cyber Security Penetration Tester Roles and Responsibilities: What Does a Pen Tester Do?
Learn what a penetration tester does, including key roles, responsibilities, daily tasks, tools, skills, reporting, and…
Cyber Security GRC Analyst Roles and Responsibilities: What Does a GRC Analyst Do?
What does a GRC analyst actually do? See the core responsibilities, how they grow by experience level, a daily routine, tools,…
Cyber Security SOC Analyst Roles and Responsibilities: What Does a SOC Analyst Do?
What does a SOC analyst actually do? Explore core responsibilities, the Tier 1–3 structure, daily tasks, tools, and skills in…