I've a yubikey4 but i'm not sure how/why i should use it. I get the 2FA case, where it provides the One Time Password to login in some services, sort of what the phone does with the authy app (or am I wrong?). But, what about the ssh access? Should the key be used to decrypt the ssh key when accessing a server? so that, if i grab anycomputer i can login on my server if I've the yubikey with me? if so, how should this work and how can I set it up?
YubiKey 4C
91–100 of 266 posts
Re: YubiKey 4C
#92Earlier quoted context omitted.
Some people will tell you to buy two Yubikeys and leave one as a backup. I don't think that's necessary. No matter what, you should generate a backup software key and keep it on offline encrypted storage; if you lose the token, just use the backup key until your replacement arrives. It's even easier for Github and Google Mail. For web services, the right stack is: * Hardware U2F token * Backup software TOTP (Duo or G…
Isn't disabled SMS overkill for most casual thread models? As I understand it SMS would require someone to MITM the telecom network OR snoop the local antenna when you receive it on your phone. Which is a danger if you expect, like, nation-state adversaries. But if I'm, say, protecting my GitHub account against Russian mafia hackers, that still seems perfectly fine?
The bigger problem for SMS-based 2FA are social engineering attacks on the support personnel of mobile network operators. They typically don't have fancy authentication schemes - it's fairly easy to get them to redirect messages to a different SIM or something like that.
Re: YubiKey 4C
#93Remember that closed source security-related products are a complete joke and you should spend your money somewhere else.
Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question. Yubikey has been around a long time and has made every effort to be a transparent company with a support for open source. Truth is, that is sometimes hard to do. I found this article rather interesting, back when it first came out: https://www.yubic…
I've seen that article and it's a heap of crap. There's no reason they couldn't make the firmware read-only so you could verify it, then publish the source to audit and verify against.
>Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question.
I can (and do) read the code for security-related software, and I can at least check for obvious backdoors and flaws myself. With reproducable builds it is possible to assert the source you see made the binary in question (and security related software must support reproducable builds for this reason).
If you want to convince yourself the product is secure, that's up to you, but it's not.
Re: YubiKey 4C
#94Earlier quoted context omitted.
You have a link? The only thing I get for u2fzero is their site with instructions on how to build one.
Closest I could find that was still available is https://amazon.com/HyperFido-K5-FIDO-U2F-Security/dp/B00WIX4...
thanks. Just what I was looking for (couldn't find the upvote button)
Re: YubiKey 4C
#95I've a yubikey4 but i'm not sure how/why i should use it. I get the 2FA case, where it provides the One Time Password to login in some services, sort of what the phone does with the authy app (or am I wrong?). But, what about the ssh access? Should the key be used to decrypt the ssh key when accessing a server? so that, if i grab anycomputer i can login on my server if I've the yubikey with me? if so, how should this…
You can use it as 2FA for your SSH installation too[1].
[1] https://www.yubico.com/why-yubico/for-businesses/computer-lo...
Re: YubiKey 4C
#96Until these things work well with phones, I can't buy into them. I have a U2F key that I use as a shortcut for accessing things like Google's services. But I am sticking to always using either Google Authenticator or SMS, if it's available, as a primary option. When I am looking at a website in bed on my phone, and my YubiKey is in my laptop downstairs, I can't say I am happy that I can't access my account.
I think the form factor for these things is just wrong. I don't always have my keys with me. I do have my phone much more frequently. Even more frequently I have things like my Pebble. Maybe some kind of NFC interface with a wrist watch would be a better alternative.
Re: YubiKey 4C
#97I bought a HyperFido but it just doesn't work on Ubuntu... Was expecting to be able to use it to log in to Google using their 2FA key.. but only works on Windows from what I can see... Anyone know anything about this?
Google supports the U2F standard for logins through Chrome. It's a theoretically standardized browser API, but it's only been implemented in Chrome so far.
Re: YubiKey 4C
#98What are the current alternatives to Yubikey? Preferably looking for something open-source and in no way associated with Google.
The U2F zero was on amazon for a while. But not anymore. Unfortunately the guy who is doing it no longer has time for it.
If you're feeling crafty, you can create your own: https://github.com/conorpp/u2f-zero/wiki/Building-a-U2F-Toke...
Re: YubiKey 4C
#99I've a yubikey4 but i'm not sure how/why i should use it. I get the 2FA case, where it provides the One Time Password to login in some services, sort of what the phone does with the authy app (or am I wrong?). But, what about the ssh access? Should the key be used to decrypt the ssh key when accessing a server? so that, if i grab anycomputer i can login on my server if I've the yubikey with me? if so, how should this…
You can actually store the key you use for SSH authentication on the Yubikey [1]. The main advantage is that the key never leaves the device, so even if your computer is compromised, your key is still safe.
Same thing goes for anything else involving GPG keys - email, signing git commits or tags, software releases, etc.
I don't personally use it for OTP. I do use it for services that support U2F (which is different from OTP, and has the main advantage of being immune to phishing).
Re: YubiKey 4C
#100Kind of useless to have a C-only device this early. An A/C-hybrid would be much more useful, like Kingston's MicroDuo[1] series. [1]: http://www.kingston.com/us/usb/personal_business/DTDUO3C
It's an authentication key, not a flash drive.
That doesn't change the fact that you may still need to use it in a friend's computer, or at an internet café.