HYPR + YubiKey Integration

By combining physical and virtual tokens, the joint solution between HYPR and Yubico ensures secure and consistent user experiences, enables organizations to meet compliance requirements, reduces risks, and improves operational efficiency. By integrating Yubico and HYPR technologies, companies can:

• Strengthen security posture across all use cases with FIDO and smart card-based MFA

•  

  Prevent man-in-the-middle attacks, credential theft, phishing attempts, and push bombing attacks

• Create a seamless and secure login experience across diverse operating systems and devices, such as Windows, MacOS, Linux, and VDI workstations

•  

  Work agnostically with all major Identity Providers (IdPs), Identity and Access Management (IAM) systems, and single signon (SSO) services

•  

  Implement a strong authentication solution without being locked into a specific product suite or platform, allowing for greater flexibility and choice

•  

  Align with regulations and best practices, with a mix of virtual and physical tokens, including PIV-compliant authentication

• Reduce costs associated with login resets, password fatigue, help desk calls, and employee downtime due to authentication issues

HYPR turns YubiKey onboarding into a self-service experience. End users pair their security keys, automatically enroll X.509 certificates, and enjoy seamless certificate renewals with no routine IT involvement required. This is done through:

• Admin Visibility: HYPR’s Console Integration gives administrators a consolidated dashboard of every YubiKey enrollment, certificate status, and recent identity verification events.
• Graceful Deprovisioning: HYPR enables endpoint-driven deprovisioning, where users retire lost or retired security keys directly from their workstation, ensuring true on-device certificate removal when possible.
• Resilient Multi-Factor Backup: Users can register multiple authentication methods or authenticator apps as primary and backup.

Yes, the PIN is still bound and used for YubiKey authentication. In the case of any hardware security key, including Yubico YubiKeys, the PIN resides on the key and unlocks the authenticator using public key/private key encryption to perform authentication.

Achieving true end-to-end security requires a strategy that extends beyond the initial implementation of phishing-resistant authentication methods and provisioning of physical security keys. When deploying physical hardware authenticators, organizations can encounter significant operational complexities:

• Identity verification for onboarding: Before a YubiKey is issued (in person or shipped), organizations must be certain of the recipient's identity
• Loss, theft, damage, and lockouts: Physical security keys can be lost, stolen, damaged, or locked due to too many failed PIN attempts, which requires a secure recovery process
• Phishable fallbacks: In the case of a lost YubiKey, reverting back to easily phished methods like SMS/voice OTPs, email links, or security questions for recovery completely undermines the security gains
• Verified Recovery: Truly secure systems require a recovery process that incorporates strong, multi-factor identity verification

You can read more about the challenges with managing hardware security keys here.

 

 

HYPR’s customizable Identity Verification (IDV) integrates directly into your onboarding flow before YubiKeys are provisioned. This process securely binds the verified physical identity to the digital identity and the associated credentials. It drastically reduces the risk of unauthorized access and establishes a trusted foundation for the user's entire lifecycle. HYPR offers a number of verification methods to align with your organization's risk tolerance:

• Device checks: HYPR first checks the device the user is verifying on to ensure it is the expected device.
• Location detection: A geolocation detection is performed and compared against expected location
• Documentation verification: Users are prompted to scan a government-issued ID (driver's license, passport), which HYPR analyzes for authenticity
• Biometric authentication: HYPR uses biometric data and facial recognition to ensure the person presenting the ID is its rightful owner
• Manager attestation: Combine live video verification and a secure chat with supervisors or IT to add an extra layer of assurance

The security gains offered by hardware keys can be instantly nullified if a user who loses their physical device can recover their account using methods susceptible to phishing, like SMS codes, email links, or knowledge-based answers (KBAs). Attackers often target these weak recovery paths at the help desk or user levels.

HYPR eliminates this vulnerability by ensuring recovery processes maintain the same high level of security as primary authentication. If a user loses their YubiKey and needs to recover access, they leverage other already registered and verified strong authentication factors managed by HYPR.