Skip to content

Latest commit

 

History

History
69 lines (60 loc) · 1.88 KB

YubiKey-OTP-Disabling-Guide.md

File metadata and controls

69 lines (60 loc) · 1.88 KB
Raw

YubiKey OTP Disabling Guide

Why Disable OTP?

Disabling YubiKey OTP (One-Time Password) functionality is beneficial if you frequently experience accidental triggers, especially with models like the Nano that remain inserted in USB ports. This change allows for more controlled use of your YubiKey while still leveraging its robust security features for authentication.

Benefits of Disabling OTP

No Impact To Other Functions

Disabling OTP doesn't affect other YubiKey functions FIDO2, U2F, and TOTP capabilities remain active

Enhanced Privacy

Reduces the risk of accidentally leaking device id through unintended OTP generation.

Reduced Embarrassment

Stops your YubiKey from generating codes when unintentionally touched.

Privacy Implications

Device ID Leakage

Each OTP contains a unique device ID that:

  • Remains constant across all codes
  • Can be used for device tracking
  • Links different activities to the same YubiKey
  • Creates a persistent identifier

OPSEC Concerns

Particularly important for:

  • Security researchers
  • Privacy advocates
  • Individuals requiring anonymity
  • Those working with sensitive information

Install

Prerequisites

  1. Add Yubico repository
sudo apt-add-repository ppa:yubico/stable
sudo apt update
  1. Install required packages
sudo apt install opensc-pkcs11 pcscd libfido2-1 fido2-tools
  1. Start pcscd service
sudo systemctl start pcscd

YubiKey Manager

  1. Install
sudo apt install yubikey-manager
  1. Verify
ykman list

Disabling

Using YubiKey Manager (ykman)

ykman config usb --disable otp

Using YubiKey Manager GUI

  1. Launch YubiKey Manager
  2. Open navigation window
  3. Select your YubiKey device
  4. Navigate to the "Toggle Applications" section
  5. Find the "OTP" application and click on it
  6. Click the "Disable" button
  7. Confirm the action when prompted