Two-factor authentication
Yubico Authenticator privacy rating
Authenticator app from Yubico that stores OATH one-time password secrets on a YubiKey instead of the phone or computer, and generates codes when the key is connected or tapped.
Summary
Yubico Authenticator scores 50 out of 100 (grade D) on the two-factor authentication criteria. It meets 2 of 4 criteria: open source and no ads or data sales. It does not meet no trackers or telemetry and independent audit. It is based in Sweden: Fourteen Eyes member; EU member (GDPR).
Score 50 out of 100. How scoring works
Criteria
-
Yes
Open source Weight 3 of 3
Is all the source code needed to run the product public?
Apache-2.0. The iOS app is in a separate repository under the same license.
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The Android app collects no data and Exodus finds no trackers, but the Yubico website loads Google Tag Manager.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Free app funded by YubiKey hardware sales, with no ads. The Play data safety listing declares no data collected or shared.
-
No
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
No independent audit is published.