header logo icon

Download "YubiKeys Hacked! - HTTAY 102 Matt"

input logo icon
Go to download
Download this video with UDL Client
  • Video mp4 HD+ with sound
  • Mp3 in the best quality
  • Any size files
"videoThumbnail YubiKeys Hacked! - HTTAY 102 Matt
play-icon
Table of contents
|

Table of contents

0:00
Intro
1:10
YubiKeys Hacked!
21:08
Outro
Similar videos from our catalog
|

Similar videos from our catalog

Video tags
|

Video tags

yubikey
hack
security
Subtitles
|

Subtitles

subtitles menu arrow
    Download
    00:00:00
    UB Keys have been hacked the point of
    00:00:02
    the key is that like it's like on your
    00:00:05
    keychain and it's actually kind of hard
    00:00:07
    to somebody's keychain out of their
    00:00:09
    pocket does anybody know how much it
    00:00:11
    costs like is for a UB key I don't know
    00:00:13
    if people know what is the process if
    00:00:14
    you lose your UB key I would have to say
    00:00:17
    that this has actually happened to me
    00:00:18
    this is why I know about uh the phone
    00:00:20
    number hijacking thing is it happened to
    00:00:22
    me like randomly for the average person
    00:00:25
    it's better to have that second Factor
    00:00:27
    than not I do really want to stress this
    00:00:30
    point though that no matter what second
    00:00:32
    Factor you use it is always more secure
    00:00:36
    than just a single Factor oh and if you
    00:00:39
    do that make sure it's not your cat's
    00:00:40
    name hello how the tech are you this is
    00:00:43
    our weekly Tech show Mostly week weekly
    00:00:46
    Tech show on Echoplex media we talk
    00:00:48
    about tech news science news and what
    00:00:50
    other any other Tech and science stuff
    00:00:53
    we feel like talking about I am
    00:00:55
    historian Matt and my co-host will
    00:00:58
    introduce them eles for their segments
    00:01:01
    I'm just going to jump right in to my
    00:01:03
    stories I've got one story it's an
    00:01:06
    interesting one but uh it's uh basically
    00:01:09
    the U Keys have been hacked uh if you
    00:01:13
    don't know anything about UB Keys
    00:01:14
    they're these little Hardware Keys
    00:01:16
    they're they're basically like uh they
    00:01:19
    they look like USB thumb drives but they
    00:01:21
    don't actually hold any data on them
    00:01:24
    that for you know saving you're not able
    00:01:26
    to save data in on them anyways but
    00:01:28
    they're specifically for security
    00:01:30
    they're the most po the UB key
    00:01:33
    specifically the most popular form of
    00:01:35
    this kind of like security key uh it's
    00:01:38
    basically a hardware token for two-
    00:01:39
    Factor authentication it's used on a
    00:01:41
    number of sites that require a higher
    00:01:44
    level of security for when you log in so
    00:01:48
    uh everybody knows about getting SMS
    00:01:51
    messages text messages on your phone for
    00:01:53
    a second Factor those are that's very
    00:01:56
    insecure uh there are other apps uh that
    00:01:59
    will give you like the the key uh it
    00:02:02
    does something very similar to these uh
    00:02:05
    UB Keys only in app form and those are
    00:02:07
    mostly secure but they have a little
    00:02:09
    they have some issues with this but
    00:02:10
    these Hardware keys are the most secure
    00:02:15
    form of this you know two-factor
    00:02:17
    authentication out there well anyways
    00:02:19
    what's happened is the UB key and other
    00:02:22
    keys that use some similar Hardware
    00:02:24
    contains a cryptographic flaw that can
    00:02:27
    allow an attacker to clone the key
    00:02:30
    basically they're stealing the the
    00:02:32
    private key and creating a new key that
    00:02:35
    can do all the same thing uh it effects
    00:02:37
    all UB Keys running firmware version
    00:02:41
    5.7 there is apparently uh I believe
    00:02:44
    there's a newer version out that um can
    00:02:48
    that doesn't have this flaw the problem
    00:02:50
    is UB Keys the firmware is not
    00:02:52
    upgradeable so these if you have these
    00:02:55
    older Keys you need to go and basically
    00:02:58
    buy a whole new key if you want to get
    00:03:00
    around this uh issue the but it's not
    00:03:04
    that big of a deal it's you know in the
    00:03:06
    news because it's the only exploit out
    00:03:07
    there for UB key so far but the only way
    00:03:10
    you can actually do this exploit is if
    00:03:13
    you have physical access to the key uh
    00:03:16
    so from the ad The Advisory that's out
    00:03:19
    for this particular flaw the attacker
    00:03:21
    would need physical possession of the UB
    00:03:23
    key security key or ubsm I don't know
    00:03:27
    what that is but I'm sure it's another
    00:03:28
    form of the key uh they would have to
    00:03:30
    have knowledge of the accounts they want
    00:03:33
    to Target and specialize equipment to
    00:03:35
    perform the necessary attack depending
    00:03:38
    on the use case the attacker may also
    00:03:40
    require additional knowledge including
    00:03:41
    username pin account password or
    00:03:44
    authentication key so there's a lot of
    00:03:47
    hurdles a lot of to to leap over to to
    00:03:50
    get this exploit to actually work so
    00:03:53
    even with this vulnerability security
    00:03:55
    Keys Remain the most secure form of two-
    00:03:58
    Factor Authentication
    00:04:00
    what do you guys think I mean I I it's
    00:04:03
    not surprising that if somebody has
    00:04:05
    physical access to the key and your
    00:04:07
    password and login information to the UB
    00:04:10
    key website they could clone the key if
    00:04:11
    they were sufficiently sophisticated I
    00:04:13
    think the point of the key is that like
    00:04:15
    it's like on your keychain and it's
    00:04:17
    actually kind of hard to somebody's
    00:04:19
    keychain out of their pocket yeah yep
    00:04:23
    well yeah it's like stealing an actual
    00:04:24
    key yeah um I do want to say though like
    00:04:28
    you mentioned that uh SMS two-factor
    00:04:31
    authentication is insecure which I'm not
    00:04:34
    going to argue that it's it's the least
    00:04:36
    secure version of two-factor
    00:04:38
    authentication but still any form of
    00:04:41
    two-factor authentication is more secure
    00:04:44
    than having just a password I guess
    00:04:47
    that's fair the issue I have with the
    00:04:49
    SMS of text messaging basically for
    00:04:51
    those who are uninitiated and I think
    00:04:52
    it's probably a little more secure now
    00:04:54
    but people uh there it's not the actual
    00:04:58
    SMS that's the problem it's uh that it's
    00:05:02
    possible to basically hijack the your
    00:05:05
    phone number and if somebody does that
    00:05:07
    basically Jacks your phone number U
    00:05:09
    moves your phone number from your phone
    00:05:12
    to another phone that they control now
    00:05:14
    they can get all your your text messages
    00:05:17
    and so if you're doing two factor and
    00:05:19
    that's the only way you have two-factor
    00:05:20
    authentication set up they can if they
    00:05:23
    can figure out your password they can do
    00:05:25
    the two- Factor authentication um that's
    00:05:27
    what I mean though is like if you're
    00:05:28
    logging in with just a password they
    00:05:31
    don't even need to do that so any two
    00:05:34
    factor is a hurdle above needing to know
    00:05:36
    your password well the other I think the
    00:05:39
    the next step is some websites will
    00:05:42
    allow you to log in basically you do a
    00:05:45
    little social engineering with just the
    00:05:47
    uh the text message basically I think
    00:05:49
    that's what some places have having a
    00:05:52
    problem with that so you that is single
    00:05:54
    Factor authentication what what was that
    00:05:57
    that at that point that is single Factor
    00:05:59
    Authentication
    00:06:00
    that is true so I mean but the average
    00:06:02
    person right like you if let's let's
    00:06:05
    like let's say you're just too lazy to
    00:06:06
    install the Google app authenticator or
    00:06:08
    whatever like on your on your phone for
    00:06:10
    the average person it's better to have
    00:06:12
    that second Factor than not because
    00:06:15
    you're for someone so first of all
    00:06:18
    someone that's going to do that is going
    00:06:20
    after you specifically and they're
    00:06:22
    probably a fairly sophisticated actor
    00:06:25
    and so if you're in a situation where
    00:06:28
    that's a likelihood or like a
    00:06:30
    possibility or likelihood like I think I
    00:06:32
    am um I I think I'm one of those people
    00:06:34
    where that's a thing that someone would
    00:06:36
    very likely attempt to do to me well
    00:06:39
    then I should never ever use uh uh text
    00:06:42
    as a second Factor but my mother I mean
    00:06:45
    come on most people my mom's age their
    00:06:46
    password is like the name of their cat
    00:06:48
    yeah okay well I I would have to say
    00:06:51
    that this has actually happened to me
    00:06:52
    this is why I know about uh the phone
    00:06:55
    number hijacking thing is it happened to
    00:06:57
    me like randomly I'd heard a little bit
    00:06:59
    about before him but then like one day
    00:07:01
    uh back when I was working at Google
    00:07:03
    like in the middle of the day I realized
    00:07:04
    I couldn't send text messages uh but
    00:07:07
    basically the phone part of my phone
    00:07:09
    wasn't working but of course since I was
    00:07:11
    on Wi-Fi because I was at work like
    00:07:13
    everything else seemed to work fine so I
    00:07:15
    didn't catch it at first but eventually
    00:07:17
    it was just lucky I think I was tried to
    00:07:19
    text somebody I don't normally do not
    00:07:22
    not that often during the day and
    00:07:23
    realized what had happened um it turns
    00:07:26
    out they were targeting my email address
    00:07:29
    and they they tried to they switched the
    00:07:31
    two-factor authentication from my phone
    00:07:34
    um I don't think I actually had
    00:07:35
    two-factor authentication set up with my
    00:07:38
    email that way uh at the time so it
    00:07:41
    didn't really help them luckily they
    00:07:43
    were trying to get in my Google email
    00:07:45
    and Google just like shut down my email
    00:07:47
    unfortunately I didn't have um other
    00:07:50
    methods to recover my email set up at
    00:07:52
    the time so I had to go through a whole
    00:07:54
    process to get back in so I strongly
    00:07:56
    suggest if you have Gmail make sure you
    00:07:59
    have other methods of two Factor
    00:08:01
    authentication set up on it and make
    00:08:03
    sure you have a recovery email stuff or
    00:08:05
    a recovery method set up uh there that's
    00:08:08
    not your phone again but uh it was a big
    00:08:11
    issue at the time for so does anybody
    00:08:13
    know how much it costs like is for a
    00:08:15
    Ubbi key because I mean this story being
    00:08:19
    what it is like who's going to does
    00:08:21
    anybody know like is it a monthly fee no
    00:08:23
    it's a one time fee for the UB key and
    00:08:26
    I'm over here uh so what they do is they
    00:08:30
    emulate a keyboard you plug them into a
    00:08:32
    USB drive or a USB slot on your computer
    00:08:36
    and they emulate a keyboard and when you
    00:08:38
    touch them when you physically push on
    00:08:40
    them they register that you're touching
    00:08:42
    them and they will spit out a bunch of
    00:08:44
    keys into uh into whatever you have uh
    00:08:50
    focused and then at the end they'll hit
    00:08:52
    the enter key you know they're virtually
    00:08:54
    hit the enter key um so a lot of times
    00:08:57
    if you see just like a bunch bunch of
    00:08:59
    random characters that someone put in
    00:09:02
    like uh slack or a tweet or something uh
    00:09:06
    it is possible that they accidentally
    00:09:08
    hit their UB key when they had like the
    00:09:11
    the input window focused yeah it would
    00:09:14
    happen a lot back at when I worked at
    00:09:16
    Facebook uh there would be you know we'd
    00:09:19
    be in slack and someone would put one of
    00:09:21
    their uh you know UB key things in in
    00:09:24
    chat accidentally by bumping their UB
    00:09:27
    key cuz we were required to have them in
    00:09:29
    our laptop and basically if you slid
    00:09:31
    your hand across the side of the laptop
    00:09:33
    they would end up spitting out one of
    00:09:35
    your authentication strings okay so I
    00:09:38
    want to get back to sort of talking
    00:09:39
    about authentication a little bit
    00:09:41
    there's basically three ways to
    00:09:42
    authenticate it's something you know
    00:09:44
    something you have and something you are
    00:09:45
    there are other ways but those are the
    00:09:47
    three I'm sure there are proba there's
    00:09:49
    probably other ways that people have
    00:09:50
    come up with so if you if you just do
    00:09:52
    something you know that's the weakest
    00:09:54
    one something you have is probably is is
    00:09:57
    more is stronger than something you know
    00:09:59
    and then something you are but it
    00:10:01
    probably may be tied with something you
    00:10:04
    have because if it's your finger and
    00:10:06
    then somebody is stronger than you and
    00:10:08
    has your
    00:10:09
    finger that's now something they have
    00:10:12
    right yeah I think it's I don't know if
    00:10:14
    any of them are particularly stronger
    00:10:15
    than the rest it's a lot has to do with
    00:10:18
    implementation and user because you know
    00:10:20
    you can have a good passord word or you
    00:10:22
    can have a very bad password right uh
    00:10:25
    but um the more of those like three
    00:10:28
    different methods of authentic ation
    00:10:29
    that you have so if you have one single
    00:10:31
    Factor you're not very secure but you're
    00:10:34
    somewhat like basic stuff it it's
    00:10:36
    probably fine two Factor authentication
    00:10:38
    is currently like the sort of the gold
    00:10:40
    standard but of course the second factor
    00:10:42
    is the you know how well that's
    00:10:43
    implemented is uh really determines how
    00:10:46
    strong that is and then nobody's
    00:10:49
    actually doing it that I know of but
    00:10:50
    three Factor authentication is
    00:10:52
    apparently the ultimate where you have
    00:10:54
    one of each of those PayPal forms of
    00:10:56
    authentication what PayPal what you do
    00:10:58
    it I didn't know that
    00:10:59
    I didn't know anybody did it um if if
    00:11:02
    you want to you can set it up so you
    00:11:03
    have to do an authenticator in your
    00:11:04
    fingerprint if you want to okay um
    00:11:07
    interesting I don't use PayPal for
    00:11:09
    reasons completely unrelated I do really
    00:11:11
    want to stress this point though that no
    00:11:14
    matter what second Factor you use it is
    00:11:17
    always more secure than just a single
    00:11:21
    Factor like even if it's just like uh a
    00:11:24
    text or an email or something that's
    00:11:27
    like relatively quote easy unquote to
    00:11:30
    hack that's still more secure than just
    00:11:32
    having a password because they have to
    00:11:34
    know your password and then something
    00:11:37
    else right I know I know that um not
    00:11:40
    long before I moved from Campbell um the
    00:11:43
    I won't give out the email oh it's a
    00:11:44
    public email address Echo Echoplex
    00:11:47
    media.com someone was definitely trying
    00:11:50
    to get in okay um because I think they
    00:11:54
    they they definitely I think they got
    00:11:55
    the password and um I just had two
    00:11:58
    Factor V via uh via the SMS and they
    00:12:02
    were unable to get in because they
    00:12:03
    didn't have my phone and that whoever it
    00:12:05
    was was not sophisticated enough to
    00:12:06
    clone my phone so all things considered
    00:12:08
    I'm glad I had the SMS uh and um but
    00:12:12
    then I was then I was like well maybe I
    00:12:15
    should use my password manager for the
    00:12:17
    authenticator I'm like no now we're a
    00:12:18
    single Factor again aren't we because if
    00:12:20
    my password manager is also the
    00:12:22
    authenticator well somebody gets into my
    00:12:24
    password manager they have the they have
    00:12:26
    the keys to everything so yep that's why
    00:12:29
    when bit Warden offers to to use like a
    00:12:34
    like a top token or or a what's it
    00:12:37
    called pass keys I'm like no I don't I
    00:12:39
    don't want bit Wen to be my only factor
    00:12:43
    and by the way if you're not using a
    00:12:45
    password manager you absolutely should
    00:12:46
    be they're free all of your passwords
    00:12:48
    should be different for every single
    00:12:50
    account that you have and you shouldn't
    00:12:51
    even know them yeah ideally you should
    00:12:54
    not have knowledge of them you should
    00:12:56
    only have one password in your brain the
    00:12:58
    pass password to your password manager
    00:13:01
    oh and if you do that make sure it's not
    00:13:02
    your cat's
    00:13:03
    name yep make sure make sure it's
    00:13:07
    annoying to type it
    00:13:09
    in also a lot of those password managers
    00:13:12
    support two-factor authentication
    00:13:13
    including using these UB Keys uh also um
    00:13:18
    because you asked earlier I did look up
    00:13:20
    how much it costs uh the cheapest UB key
    00:13:22
    this is a UB key 5 is $50 it was more
    00:13:25
    than I expected I thought they were like
    00:13:26
    $20 but uh $50 buy a used don't buy a
    00:13:30
    used UB key I don't know um I don't know
    00:13:32
    what the problems might be but um that's
    00:13:34
    the thing is they they're probably a
    00:13:36
    neat and interesting ways that people
    00:13:38
    might be selling not used Ubbi Keys yeah
    00:13:42
    there's also a thing well I didn't look
    00:13:45
    this up but I I think in yub key if
    00:13:46
    you're a big business or medium business
    00:13:49
    maybe or at least a business that's very
    00:13:51
    security conscious you can buy basically
    00:13:54
    like the blank uh UB keys so you write
    00:13:57
    the keys yourself so no other company
    00:14:00
    has the keys ever at your own your own
    00:14:03
    company but uh I think they still do
    00:14:05
    that I I'm pretty sure they did it
    00:14:07
    before but uh don't take my word for it
    00:14:09
    if you're interested in that thing I I
    00:14:11
    don't know if people know what is the
    00:14:12
    process if you lose your UB key uh
    00:14:14
    you're [ __ ] no um depends on you know
    00:14:19
    the whatever you're using um you just
    00:14:23
    unregister it in your account the the
    00:14:25
    way the UB works is like uh there's the
    00:14:28
    part on the key itself which just
    00:14:31
    essentially does like kind of like
    00:14:33
    public keep
    00:14:35
    cryptography uh and then there's the
    00:14:37
    part on the the server that you know
    00:14:40
    you've stored your password on the
    00:14:41
    server and this other part of the UB key
    00:14:44
    and when you push on the button the UB
    00:14:47
    key just does a little calculation uh
    00:14:50
    that it has to know like the private
    00:14:52
    part of the part that's stored on the
    00:14:53
    server and then it'll spit out a bunch
    00:14:56
    of like gobbledygook and then send that
    00:14:59
    to the server and the server can verify
    00:15:01
    okay yes the thing that corresponds to
    00:15:04
    this public part that I have is the
    00:15:07
    private part so it's kind of like uh
    00:15:10
    pass keys where you have a a private key
    00:15:12
    and a public key and the public key is
    00:15:15
    stored on the server and you have to
    00:15:16
    sign something with your private key to
    00:15:19
    authenticate to the server uh it's
    00:15:21
    similar to that so you just deregister
    00:15:24
    it on the server if you lose it well the
    00:15:25
    problem is like how do you get onto the
    00:15:27
    server if you if you lost your key to
    00:15:28
    begin with right uh and one of the
    00:15:30
    things you can do social engineering is
    00:15:32
    you can some websites allow you to to
    00:15:34
    register multiple keys so you have one
    00:15:37
    your daily driver key and then you would
    00:15:39
    have another one that may keeping a safe
    00:15:41
    or something so like like sort of sort
    00:15:43
    almost like a 321 backup solution right
    00:15:45
    where you yes where you have one of the
    00:15:47
    you have the essentially you'd have the
    00:15:49
    password which would be the first thing
    00:15:51
    you'd have a UB key that's on site and
    00:15:52
    then maybe a UB key offsite like you
    00:15:55
    that you leave in a drawer at your mom's
    00:15:56
    house or some [ __ ] right well yeah I
    00:15:58
    mean you'd probably ones that you don't
    00:16:00
    have physical access to you know
    00:16:03
    immediate physical access to you
    00:16:05
    probably want to put in a safe somewhere
    00:16:07
    so maybe a safe at your mom's house but
    00:16:09
    well but otherwise again like how like
    00:16:12
    what are you a
    00:16:13
    spy hey I'm just saying like keep it
    00:16:16
    safe so ultimately uh whatever you're
    00:16:20
    logging into like they determine whether
    00:16:23
    you can authenticate so like you know if
    00:16:25
    I uh like Dave if you lost your password
    00:16:28
    to Port 87 I could let you in like I
    00:16:31
    could just change your password on the
    00:16:32
    server right but you would be
    00:16:33
    authenticating like if if something
    00:16:35
    happened you you you would not
    00:16:37
    authenticate me via a Discord message or
    00:16:39
    anything like you know what I'm saying
    00:16:40
    you would correct I would you would you
    00:16:42
    would you You' either be like you need
    00:16:43
    to call me from the phone you need to do
    00:16:45
    a video call we need to do something so
    00:16:47
    that I know this is actually [ __ ] you
    00:16:49
    but the other thing is you but you you
    00:16:50
    wouldn't do that but hold on you
    00:16:52
    wouldn't do that for other people on
    00:16:53
    Port 87 because they're not your friend
    00:16:56
    so you can't really authenticate who the
    00:16:57
    hell they are in the first place I would
    00:17:00
    do that but I would require them to send
    00:17:03
    me an email from the email that is
    00:17:05
    listed as their recovery email and then
    00:17:08
    include like a a picture of their
    00:17:09
    driver's license basically to prove that
    00:17:12
    they are really them so that's the way
    00:17:14
    Facebook does it if you lose your
    00:17:15
    Facebook if you lose access to your
    00:17:17
    Facebook account you can recover your
    00:17:19
    Facebook password by essentially sending
    00:17:22
    them your driver's license and if the
    00:17:25
    picture on your driver's license or the
    00:17:27
    uh the name on your driver's license
    00:17:28
    match matches the name on your Facebook
    00:17:30
    account then they'll let you reset your
    00:17:32
    password through that email that is your
    00:17:35
    recovery email right and for me if I
    00:17:37
    lost my personal Facebook account that
    00:17:39
    might be one of them good problems
    00:17:40
    because I have so many burners on
    00:17:42
    Facebook that that have I have so many
    00:17:44
    burners on Facebook and other other ways
    00:17:47
    to access the um public page for
    00:17:50
    Echoplex media such as being like hey
    00:17:52
    Matt can you post this thing for me on
    00:17:55
    Facebook but um yeah this is I don't I
    00:17:58
    mean I'm not not you know if somebody
    00:17:59
    would have told me um that if you know
    00:18:02
    someone because this is someone would
    00:18:03
    have to be pretty sophisticated not just
    00:18:06
    technically but um in a social
    00:18:07
    engineering way to get a hold of your U
    00:18:10
    key and then clone it well yeah I mean
    00:18:11
    that's the silly thing like if they get
    00:18:13
    a hold of your U key they could just use
    00:18:15
    it yeah what the [ __ ] do they need what
    00:18:16
    the [ __ ] do they need a copy of it and
    00:18:19
    it's like I mean you have to have like
    00:18:20
    an oscilloscope or something like or
    00:18:22
    special oscilloscope to be able to get
    00:18:25
    the information you need to clone it
    00:18:27
    using this method
    00:18:29
    um so like it's not something you just
    00:18:31
    like quickly like have it for a couple
    00:18:33
    seconds you know and get it back you
    00:18:35
    actually have to take the key apart a
    00:18:37
    bit to to access the the chips and and
    00:18:40
    do it and uh it's I
    00:18:42
    mean you're right at that point why not
    00:18:44
    just [ __ ] steal it yeah then you just
    00:18:46
    steal steal the key but then still like
    00:18:49
    that's the SEC the UB key is like a
    00:18:50
    second factor in addition to a password
    00:18:52
    right correct mhm now I want one or
    00:18:55
    actually I want two yeah good good idea
    00:18:57
    you might want more than that because I
    00:18:59
    told you the multiple prices the
    00:19:00
    multiple prices are for different ways
    00:19:03
    of connecting cuz they're not all just
    00:19:05
    USB some are
    00:19:06
    USBC some are U I don't know what is the
    00:19:10
    the old uh SD iPhone I don't know if
    00:19:13
    they have an SD card one they might but
    00:19:15
    they also have and some of them were
    00:19:17
    support uh was it NFC yeah uh so you
    00:19:20
    don't even have to it in also UB is not
    00:19:23
    the only vendor there are other
    00:19:25
    manufacturers of uh like Hardware based
    00:19:28
    B two Factor authentication uh UB key I
    00:19:31
    think is just the most popular and the
    00:19:34
    most supported across you know every
    00:19:36
    everywhere that allows two Factor
    00:19:38
    authentication the other one that's real
    00:19:40
    cool they used to be and I think they
    00:19:42
    were running on like the old pager
    00:19:43
    Network sort of I'm not sure but they
    00:19:45
    were these little L LCD screens that
    00:19:48
    were like maybe about this big and they
    00:19:50
    just rotate a rotate a password and it
    00:19:52
    would be that's
    00:19:53
    top uh top is uh a time-based algorithm
    00:19:59
    that basically is as long as I know a
    00:20:01
    secret and you know a secret we can both
    00:20:04
    calculate what that top top code should
    00:20:08
    be at this time and usually you'll have
    00:20:10
    a window of like a couple minutes where
    00:20:12
    any code within that couple minutes will
    00:20:15
    be taken uh so like Port 87 does top
    00:20:19
    codes U and I have it set up so that a
    00:20:21
    code will work 2 minutes into the past
    00:20:24
    and 2 minutes into the future so you
    00:20:25
    have a 4minute window to enter a code uh
    00:20:29
    where you know if if that code as you're
    00:20:32
    typing it in like flips over it'll still
    00:20:35
    work there's supposed to be valid for
    00:20:37
    like exactly 30 seconds but everywhere
    00:20:39
    puts in this window cuz like my clock on
    00:20:43
    my phone might not be the same as the
    00:20:45
    clock on the server that I'm trying to
    00:20:47
    log into right and it might just take
    00:20:49
    you who knows how long it takes you to
    00:20:51
    type the thing in and like well you're
    00:20:53
    like oh crap I got to look yeah yeah
    00:20:54
    there's all kind of stuff anyway uh we
    00:20:56
    ended up kind of In The Weeds on that
    00:20:58
    but that's good maybe we should do an
    00:20:59
    entire uh show about uh security and um
    00:21:02
    maybe security and backup for an entire
    00:21:04
    show sometime I think that'd be a good
    00:21:05
    idea good yeah I would like that I love
    00:21:07
    that topic all right everybody thanks
    00:21:09
    for checking out how the tech are you
    00:21:11
    you can find this on every podcaster and
    00:21:13
    on YouTube if you'd like to support this
    00:21:15
    project just go to Echoplex media.com
    00:21:17
    click the support Link at the top of the
    00:21:19
    website I don't know click around there
    00:21:21
    too I write one blog post a year you
    00:21:23
    should read my most recent one you can
    00:21:25
    check out our other shows my other shows
    00:21:27
    uh twitch.tv / Echoplex media and uh
    00:21:30
    have a great Tekken week

    Description:

    Support us on Patreon! https://www.patreon.com/echoplex Matt - YubiKeys Hacked! 0:00 Intro 1:10 YubiKeys Hacked! 21:08 Outro Show Notes https://docs.google.com/document/d/1oeBaRiL9-OY9P9uYinFfopycUbUCcb-gvSFq-Ek-mnI/pub Listen to the Podcast Version of the Show Apple - https://podcasts.apple.com/us/podcast... Spotify - https://open.spotify.com/show/6jRoMxu... Stitcher - https://www.pandora.com/restricted Everything Else - https://podnews.net/podcast/i9zlk Find the Show Online https://www.echoplexmedia.com/httay Join Mastodon on Port87 Social! https://port87.social/ Find us on Mastodon Matt - https://port87.social/@HistMatt HK - https://port87.social/@hperrin Dave - https://port87.social/@dave Echoplex - https://port87.social/@echoplex Find us on Twitter Matt - https://twitter.com/macourtney1 HK - https://twitter.com/hkperrin Dave - https://twitter.com/mistahbuhau Echoplex - https://twitter.com/EplexM

    Mediafile available in formats

    popular icon
    Popular
    hd icon
    HD video
    audio icon
    Only sound
    total icon
    All
    Show formatsreload icon
    * — If the video is playing in a new tab, go to it, then right-click on the video and select "Save video as..."
    ** — Link intended for online playback in specialized players

    Questions about downloading video

    question iconHow can I download "YubiKeys Hacked! - HTTAY 102 Matt" video?arrow icon

      http://univideos.ru/ website is the best way to download a video or a separate audio track if you want to do without installing programs and extensions.

      The UDL Helper extension is a convenient button that is seamlessly integrated into YouTube, Instagram and OK.ru sites for fast content download.

      UDL Client program (for Windows) is the most powerful solution that supports more than 900 websites, social networks and video hosting sites, as well as any video quality that is available in the source.

      UDL Lite is a really convenient way to access a website from your mobile device. With its help, you can easily download videos directly to your smartphone.

    question iconWhich format of "YubiKeys Hacked! - HTTAY 102 Matt" video should I choose?arrow icon

      The best quality formats are FullHD (1080p), 2K (1440p), 4K (2160p) and 8K (4320p). The higher the resolution of your screen, the higher the video quality should be. However, there are other factors to consider: download speed, amount of free space, and device performance during playback.

    question iconWhy does my computer freeze when loading a "YubiKeys Hacked! - HTTAY 102 Matt" video?arrow icon

      The browser/computer should not freeze completely! If this happens, please report it with a link to the video. Sometimes videos cannot be downloaded directly in a suitable format, so we have added the ability to convert the file to the desired format. In some cases, this process may actively use computer resources.

    question iconHow can I download "YubiKeys Hacked! - HTTAY 102 Matt" video to my phone?arrow icon

      You can download a video to your smartphone using the website or the PWA application UDL Lite. It is also possible to send a download link via QR code using the UDL Helper extension.

    question iconHow can I download an audio track (music) to MP3 "YubiKeys Hacked! - HTTAY 102 Matt"?arrow icon

      The most convenient way is to use the UDL Client program, which supports converting video to MP3 format. In some cases, MP3 can also be downloaded through the UDL Helper extension.

    question iconHow can I save a frame from a video "YubiKeys Hacked! - HTTAY 102 Matt"?arrow icon

      This feature is available in the UDL Helper extension. Make sure that "Show the video snapshot button" is checked in the settings. A camera icon should appear in the lower right corner of the player to the left of the "Settings" icon. When you click on it, the current frame from the video will be saved to your computer in JPEG format.

    question iconHow do I play and download streaming video?arrow icon

      For this purpose you need VLC-player, which can be downloaded for free from the official website https://www.videolan.org/vlc/.

      How to play streaming video through VLC player:

      • in video formats, hover your mouse over "Streaming Video**";
      • right-click on "Copy link";
      • open VLC-player;
      • select Media - Open Network Stream - Network in the menu;
      • paste the copied link into the input field;
      • click "Play".

      To download streaming video via VLC player, you need to convert it:

      • copy the video address (URL);
      • select "Open Network Stream" in the "Media" item of VLC player and paste the link to the video into the input field;
      • click on the arrow on the "Play" button and select "Convert" in the list;
      • select "Video - H.264 + MP3 (MP4)" in the "Profile" line;
      • click the "Browse" button to select a folder to save the converted video and click the "Start" button;
      • conversion speed depends on the resolution and duration of the video.

      Warning: this download method no longer works with most YouTube videos.

    question iconWhat's the price of all this stuff?arrow icon

      It costs nothing. Our services are absolutely free for all users. There are no PRO subscriptions, no restrictions on the number or maximum length of downloaded videos.