# \[Crypto\] Time-based one-time password (TOTP) for 2FA, part II: YubiKey

DevFeed: [\[Crypto\] Time-based one-time password (TOTP) for 2FA, part II: YubiKey](<https://devfeed.tech/articles/crypto-time-based-one-time-password-totp-for-2fa-part-ii-yubikey-20551.md>)

Original publisher: [Read original article](<https://yurichev.com/blog/TOTP2/>)

Published: 2026-09-13T22:00:00Z

Content type: article

Language: en

Sources: [Dennis Yurichev](<https://devfeed.tech/sources/dennis-yurichev.md>)

Topics: [passwords](<https://devfeed.tech/topics/passwords.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [Code](<https://devfeed.tech/topics/code.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Android](<https://devfeed.tech/topics/android.md>), [USB](<https://devfeed.tech/topics/usb.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [code](<https://devfeed.tech/tags/code.md>), [command-line](<https://devfeed.tech/tags/command-line.md>), [linux](<https://devfeed.tech/tags/linux.md>), [password](<https://devfeed.tech/tags/password.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [usb](<https://devfeed.tech/tags/usb.md>)

## AI overview

The article examines using a YubiKey to store TOTP secrets for two-factor authentication. It explains that HMAC keys are intended to remain inside the device, but describes a Linux ykman weakness that could allow an attacker with temporary physical access to generate future TOTP keys and potentially log in during the relevant 30-second interval if the account password is also known.

## Source excerpt

[Crypto] Time-based one-time password (TOTP) for 2FA, part II: YubiKey