Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 4C

yubico.com

Post reply on HN
Print view View original

101–110 of 266 posts

Re: YubiKey 4C

#101

Post by sdwisely »

eumoria wrote: post #50
LeifCarrotson wrote: post #34

Earlier quoted context omitted.

> Not having it inserted defeats the whole point How so? I would keep this on a keychain or lanyard (it looks rugged enough to handle that sort of environment). When I need to authenticate, I plug it in, when I'm done, I unplug it. That seems a lot more secure than leaving it in the computer all the time. If someone gets my computer and the YubiKey is always installed, that sort of defeats the purpose of having a sep…

I've had the standard USB version on my keys for about a year at this point. They're in my back pocket and take a bunch of abuse. Still works just fine.

Yup, mine has been on my keys and in use for nearly 6 years now and it works just as well as it did the day I bought it.

Re: YubiKey 4C

#102

Post by StavrosK »

tptacek wrote: post #58

Note that this isn't just a U2F key; if you're looking for a token principally to log into web services with, this isn't what you want, and the token that does that costs less than half as much (it's the U2F-only token). You want a Y4 if: * You SSH into sensitive machines. * You log into a VPN that you control and can configure to use the Y4. * You're actually relying on PGP.

Does anyone have a guide on how to store an SSH key on it? I only found PGP key guides (and I have my key on it), but not much for SSH. I also think it doesn't do ECC...

Re: YubiKey 4C

#103

Post by esseti »

pfg wrote: post #99
esseti wrote: post #91

I've a yubikey4 but i'm not sure how/why i should use it. I get the 2FA case, where it provides the One Time Password to login in some services, sort of what the phone does with the authy app (or am I wrong?). But, what about the ssh access? Should the key be used to decrypt the ssh key when accessing a server? so that, if i grab anycomputer i can login on my server if I've the yubikey with me? if so, how should this…

You can actually store the key you use for SSH authentication on the Yubikey [1]. The main advantage is that the key never leaves the device, so even if your computer is compromised, your key is still safe. Same thing goes for anything else involving GPG keys - email, signing git commits or tags, software releases, etc. I don't personally use it for OTP. I do use it for services that support U2F (which is different f…

i'll give it a look. the potetntial of this device is still not clear to me.

Re: YubiKey 4C

#104

Post by rogerbinns »

ionised wrote: post #25

What are the current alternatives to Yubikey? Preferably looking for something open-source and in no way associated with Google.

I haven't used it, but Trezor looks interesting, and there is a Trezor 2 coming soon. https://trezor.io/

The sweet spot is for Bitcoin wallets, but it does the other stuff (U2F, ssh, gpg, passwords). Hardware is interesting. Everything open source. You can add your own "apps".

U2F: https://blog.trezor.io/secure-two-factor-authentication-with...

Re: YubiKey 4C

#105

Post by [deleted] »

rogerbinns wrote: post #104
ionised wrote: post #25

What are the current alternatives to Yubikey? Preferably looking for something open-source and in no way associated with Google.

I haven't used it, but Trezor looks interesting, and there is a Trezor 2 coming soon. https://trezor.io/ The sweet spot is for Bitcoin wallets, but it does the other stuff (U2F, ssh, gpg, passwords). Hardware is interesting. Everything open source. You can add your own "apps". U2F: https://blog.trezor.io/secure-two-factor-authentication-with...

[deleted]

Re: YubiKey 4C

#106

Post by pfg »

StavrosK wrote: post #102
tptacek wrote: post #58

Note that this isn't just a U2F key; if you're looking for a token principally to log into web services with, this isn't what you want, and the token that does that costs less than half as much (it's the U2F-only token). You want a Y4 if: * You SSH into sensitive machines. * You log into a VPN that you control and can configure to use the Y4. * You're actually relying on PGP.

Does anyone have a guide on how to store an SSH key on it? I only found PGP key guides (and I have my key on it), but not much for SSH. I also think it doesn't do ECC...

You can use the GPG key on the device for SSH authentication through gpg-agent. Here's their documentation[1] for this feature.

ECC keys should work, but haven't tried that (I use RSA-4096).

[1]: https://developers.yubico.com/PGP/SSH_authentication/

Re: YubiKey 4C

#107

Post by bergie »

IgorPartola wrote: post #96

Until these things work well with phones, I can't buy into them. I have a U2F key that I use as a shortcut for accessing things like Google's services. But I am sticking to always using either Google Authenticator or SMS, if it's available, as a primary option. When I am looking at a website in bed on my phone, and my YubiKey is in my laptop downstairs, I can't say I am happy that I can't access my account. I think t…

They have a NFC yubikey available, and most new phones work with USB-C (which this one has)

Re: YubiKey 4C

#108

Post by danjoc »

johnnycarcin wrote: post #72
danjoc wrote: post #48

Earlier quoted context omitted.

When I first got mine, I was the same way. I learned different bits in steps. First was yubikey-luks for full disk encryption. Then using my ssh key on it. Then GPG key on it. Then using GPG key for password storage with QTPass, OpenKeychain/Android Password Store. Then 2FA with gmail. I'm getting a lot more use out of mine more than a year after originally getting it.

For the ssh key, are you using your yubikey on multiple computers or just one? I just started looking at this but it seems like there is a bit of setup needed for each computer. I guess it might be worth it but would be interested to hear about others experiences.

Yeah, it does require some setup on the ssh client machine. So far, I only set up my home laptop with it. It's probably not hard on the work machine, but different OS so I haven't tried.

Re: YubiKey 4C

#109

Post by KirinDave »

Sir_Cmpwn wrote: post #93
KirinDave wrote: post #83

Earlier quoted context omitted.

Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question. Yubikey has been around a long time and has made every effort to be a transparent company with a support for open source. Truth is, that is sometimes hard to do. I found this article rather interesting, back when it first came out: https://www.yubic…

I've seen that article and it's a heap of crap. There's no reason they couldn't make the firmware read-only so you could verify it, then publish the source to audit and verify against. >Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question. I can (and do) read the code for security-related software, and…

You obviously didn't read the article. There is no way for you to actually do that. And the secure platforms themselves have NDAs around their specs and software tooling.

So yeah, there is a reason they didn't do that. The hardware they're using specifically makes it difficult to do the verification you want to do. Which is directly related to foiling the kind of attacks they want to foil.

> If you want to convince yourself the product is secure, that's up to you, but it's not

I think we have the same goal, but you have a conviction that open source stops "obvious back doors." It in no way would help that at all in this case. The hardware is configured before it is shipped, then locked in a way designed to prevent rewriting or inspection. You have no rational basis for the belief that the source code on a website and the binary a malicious and deceptive actor would deploy to the hardware are the same thing.

Being open source only affects the way security auditing can be done. It doesn't guarantee better quality.

Re: YubiKey 4C

#110

Post by Sir_Cmpwn »

KirinDave wrote: post #109
Sir_Cmpwn wrote: post #93

Earlier quoted context omitted.

I've seen that article and it's a heap of crap. There's no reason they couldn't make the firmware read-only so you could verify it, then publish the source to audit and verify against. >Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question. I can (and do) read the code for security-related software, and…

You obviously didn't read the article. There is no way for you to actually do that. And the secure platforms themselves have NDAs around their specs and software tooling. So yeah, there is a reason they didn't do that. The hardware they're using specifically makes it difficult to do the verification you want to do. Which is directly related to foiling the kind of attacks they want to foil. > If you want to convince y…

I have read the article, several times, thank you very much. Don't take the easy way out by dismissing the opposition as ignorant.

>So yeah, there is a reason they didn't do that. The hardware they're using specifically makes it difficult to do the verification you want to do. Which is directly related to foiling the kind of attacks they want to foil.

Then they've chosen the wrong hardware. This doesn't make it more secure, it just explains why their product is insecure.

>I think we have the same goal, but you have a conviction that open source stops "obvious back doors." It in no way would help that at all in this case. The hardware is configured before it is shipped, then locked in a way designed to prevent rewriting or inspection. You have no rational basis for the belief that the source code on a website and the binary a malicious and deceptive actor would deploy to the hardware are the same thing.

I already addressed this - reproducable builds. I don't have to take anyone's word for it.

Post reply on HN