Has anyone experience or thoughts on various password manager schemes and/or hardware tokens? Specifically, I am looking into a Yubikey NEO, possibly in conjunction with LastPass premium (at $12/year). Password managers kind of give me the willies, but right now I have a disturbing amount of my life tied to two Google accounts and I'd like to diversify and further enable meaningful 2-factor authentication. I have it enabled now on web accounts that allow it (Google, Twitter, etc.), but I'd like to go farther. I've read enough tech docs and forum posts on the YubiKey device to believe that people are actually able to implement its use for things like PGP, SSH keys, and local system logins. (The advantage of the NEO over the cheaper models is the NFC capability, which would let me use it to secure my Android-based Nexus 7 tablet.)

Eh, I ordered one. I'll let you know.

How do Google and Twitter tie into third party auth tokens?

I have the original yubikey which I like a lot. It took some work to incorporate into my existing server logins though. A lot of public services don't work with yubikey unless you take advantage of the static password option which allows for a constant (long) password to be inputed (both static and OTP options can be used). My wife uses and likes LastPass a lot for her business. I agree the newer NFC model of yubi key would add some flexibility although I have been able to use the yubi key with my android phone by connecting the yubi key to a USB to Go adapter which was connected to my phone (galaxy 3).

I have tried KeePass a couple of times but had difficulty using on multiple system (syncronizing) - at the time, I read about using dropbox but I don't really care for dropbox. Currently, I have a gpg encrypted file that I store on a git server which I can pull from for any of the computers that I need to access it from.

When are web sites going to start letting us authenticate with a public key?!

I am really excited to see where SQRL (https://www.grc.com/sqrl/sqrl.htm) authentication ends up. I have listened to several of Steve Gibson's podcasts about SQRL with Leo Leporte and really hope that it turns into a good solution.

I haven't actually done much with the YubiKey aside from use it to prove I'm me before I can access the LastPass on a given system. I am a pretty big fan of LastPass; my wife has also started using it. Paying the 12/year for the premium version lets me use it with my tablet also, and that's how I interact with the rest of the world a good deal of the time. Worthwhile for me.

An electronic billboard has not lived up to its full potential until it displays Goatse.

I was interested to learn that the (sadly now defunct) Orion Incident Response Live CD, geared at blue team collaboration in a compromised environment, used Citadel for team communication. A SANS white paper from 2010:
http://www.sans.org/reading-room/whitepapers/incident/orion-incident-response-live-cd-33368

That is huge! How did I not know about that!

IG - Reading through that I'm like "DAYUMMM!!!!" Is very neat.

I took an online training module in the Protected Critical Infrastructure Information (PCII) program a few weeks ago. It was mostly pretty common-sense stuff about protecting information in the program, but had some really stupidly bad advice sprinkled in here and there. For example, when talking about how to send PCII over e-mail, if that becomes necessary, the slides instructed you to do the following (copied from a screen shot):

-Ensure the PCII document password is NOT included in the e-mail you've attached the PCII to

-Send the email

-Send the password to the protected PCII document in a separate email that uses a different subject line