Note that for Facebook, the YubiKey can only log you in if you're using the latest version of Chrome or Opera. Yubikeys provide one-touch login without requiring a mobile phone to complete an authentication challenge.Įxample, let's set up a YubiKey to work with Facebook.

Therefore, the credentials you create in a server are linked directly to a single website. Registering a new key to a server sends an AppID that could be the website URL you're trying to authenticate. One of the advantages of using a Yubikey is that they protect against phishing attacks. The server decrypts the challenge using the public key it already has, and if the challenge matches the one the server sent, it means the user authentication was successful. If everything goes well, your Yubikey encrypts the challenge sent by the server with the private key and sends the challenge back. The browser prompts you to tap the Yubikey, and the Yubikey will use the information received in step 1 to re-create the same key pair created when you registered your Yubikey.

The server remembers you had registered a Yubikey, so it generates a new challenge to send back along with the AppID and nonce created when you first registered your Yubikey.

Amazon account yubikey