We know that for example Facebook is combining Duo Security and Yubico's Yubikey USB hardware tokens.
And Duo Security's administration tools are interesting, regardless of where the token comes from.
Now we also have U2F support in both Duo, Yubikeys and Google Accounts.

Would it be possible to use Duo Security as the central and Mobile app, and set the authentication to require Yubikeys on the client? That would be _very_ interesting, especially if they can then be used to authenticate into Google Accounts as well, having the U2F user accounts and keys administered from the Duo Admin service.

For example, use the App on a smartphone, but ONLY with a physical Yubikey, not accepting the app's internal OTP, only the one coming from a valid Yubikey.

And, as the title suggests, we would have even greater flexibility and security if we could use this Drupal module, perhaps in conjunction with the existing https://www.drupal.org/project/yubikey module to enable selecting EITHER to authenticate the Yubikey through the Yubico online service, or if that one is unavailable or having problems, the user could use the same Yubikey against the Duo service and be logged into the Drupal site.

Comments

DuoSupport’s picture

DuoSupport commented

Perhaps I'm misunderstanding the question, but Duo already supports authenticating Yubico devices in Yubico OTP mode.

You may also enforce use of Yubico devices via Duo by disabling other authenticator types in the Duo Admin Panel.

Leeteq’s picture

Leeteq commented

The Yubikey can be configured to use various authentication standards, its own home-grown OTP service is one, the new U2F standard from the Fido.org alliance is another.

My question is related to whether it is possible to use Yubikey with Duo in cases when the Yubico authentication server is down or unresponsive, as an alternative to the authentication site, still using the Yubikey. It would be great to add a fallback to the authentication in case one service is down, use the other.

However, I think that this would perhaps only work if configuring two slots in the same Yubikey differently, one to use the Yubico OTP service, and the other to use U2F, if Duo supports that one, or even Symantec VIP for that matter (also supported, but only by one of the Yubikey models).

Ideally, Duo could consider running their own Yubikey Server (it is open source(!)) as an alternative.

My question is actually also about whether it is possible to select which of the two main services; Yubico OTP or U2F that Duo should use with the chosen Yubikey. Do we have a configurable option, or is it only passing the request on to the Yubico server, and thus failing with no fallback option if that service is unresponsive?

When more and more of us starting to really rely on 2FA, we dont want to have to rely only one authentication server/service... There could be an interesting extra market potential for Duo here, I think.

DuoSupport’s picture

DuoSupport commented

Duo already validates all Yubikey modes directly, including Yubico OTP and U2F, without ever contacting Yubico. So yes, it is possible to use Yubikey in any mode if Yubico is down or unresponsive.

As for using OTP and U2F modes on the same device, U2F mode does not take up a slot on the Yubikey NEO or NEO-N. The presence of the FIDO U2F browser extension in a pending authentication state is automatically detected by a U2F enabled Yubikey, causing the Yubikey to initiate a U2F authentication. Otherwise the key will use OTP mode. Again, Yubico is not a part of the authentication process here. But if you experience some issue with U2F authentication you can simply select passcode authentication as a fallback when logging in.

Leeteq’s picture

Leeteq commented

Well, that sounds excellent. Will test these things shortly. Thanks for your explanations.
I suggest keeping this issue open for a while, for visibility. This should be interesting for many people.