Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 4C

yubico.com

Post reply on HN
Print view View original

121–130 of 266 posts

Re: YubiKey 4C

#121

Post by wyager »

rogerbinns wrote: post #104
ionised wrote: post #25

What are the current alternatives to Yubikey? Preferably looking for something open-source and in no way associated with Google.

I haven't used it, but Trezor looks interesting, and there is a Trezor 2 coming soon. https://trezor.io/ The sweet spot is for Bitcoin wallets, but it does the other stuff (U2F, ssh, gpg, passwords). Hardware is interesting. Everything open source. You can add your own "apps". U2F: https://blog.trezor.io/secure-two-factor-authentication-with...

Trezor is great. Tiny device, big enough display, good build quality.

Re: YubiKey 4C

#123

Post by wyager »

fuzzybeard wrote: post #70
jupp0r wrote: post #22

Until there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats the whole point.

This isn't something you should leave plugged in. It's a key after all used for authentication. Keep it on your keychain or in your wallet and plug in as needed.

If it's sufficient to authenticate a particular machine, not necessarily a particular user, leaving it plugged in is acceptable and convenient.

Re: YubiKey 4C

#124

Post by lorenzhs »

IgorPartola wrote: post #96

Until these things work well with phones, I can't buy into them. I have a U2F key that I use as a shortcut for accessing things like Google's services. But I am sticking to always using either Google Authenticator or SMS, if it's available, as a primary option. When I am looking at a website in bed on my phone, and my YubiKey is in my laptop downstairs, I can't say I am happy that I can't access my account. I think t…

On Android, the Google Authenticator app handles U2F via NFC. Sadly not possible on iOS.

Re: YubiKey 4C

#125

Post by cdsboy »

johnnycarcin wrote: post #72
danjoc wrote: post #48

Earlier quoted context omitted.

When I first got mine, I was the same way. I learned different bits in steps. First was yubikey-luks for full disk encryption. Then using my ssh key on it. Then GPG key on it. Then using GPG key for password storage with QTPass, OpenKeychain/Android Password Store. Then 2FA with gmail. I'm getting a lot more use out of mine more than a year after originally getting it.

For the ssh key, are you using your yubikey on multiple computers or just one? I just started looking at this but it seems like there is a bit of setup needed for each computer. I guess it might be worth it but would be interested to hear about others experiences.

It's very easy to setup on linux, but does require a fair bit of setup to get it to work with windows. I haven't set it up on OS X but I expect it to be about as easy as linux.

I've been SSH w/ yubikey key only for about 6 months now and haven't had any issues with it. I regularly move between multiple computers. Once I set it up on one computer I've never had it take more than 15 minutes to get up and running on any computer I've need it on (window or linux).

The only thing I'm really missing is the ability to log into my server from my phone. There was some talk of getting ConnectBot and Open-Keychain talking to each other to get this working but it appears to be stalled.

Re: YubiKey 4C

#126

Post by StavrosK »

pfg wrote: post #106
StavrosK wrote: post #102

Earlier quoted context omitted.

Does anyone have a guide on how to store an SSH key on it? I only found PGP key guides (and I have my key on it), but not much for SSH. I also think it doesn't do ECC...

You can use the GPG key on the device for SSH authentication through gpg-agent. Here's their documentation[1] for this feature. ECC keys should work, but haven't tried that (I use RSA-4096). [1]: https://developers.yubico.com/PGP/SSH_authentication/

Thank you, I seem to recall trying gpg-agent but I'm not sure I went anywhere with it. Will try again.

Re: YubiKey 4C

#127

Post by mrmondo »

I wish you could use these with macOS's CoreStorage to unlock FileVault 2's full disk encryption in combination with a password. I wonder if it'll be possible at any point...

Re: YubiKey 4C

#128

Post by StavrosK »

amitshah wrote: post #113
StavrosK wrote: post #102

Earlier quoted context omitted.

Does anyone have a guide on how to store an SSH key on it? I only found PGP key guides (and I have my key on it), but not much for SSH. I also think it doesn't do ECC...

There's this very nice guide that works well for Linux machines: https://github.com/lfit/ssh-gpg-smartcard-config/blob/master...

I'll give that a shot, thank you!

Re: YubiKey 4C

#129

Post by unicornporn »

dgacmu wrote: post #115
bergie wrote: post #107

Earlier quoted context omitted.

They have a NFC yubikey available, and most new phones work with USB-C (which this one has)

I can confirm that the NFC support works (yubikey neo with a nexus 5x) - but very few applications and sites support it.

Do you know if it will work with a 5X running Copperhead OS (no gapps)? Ie. is the apk available?

Re: YubiKey 4C

#130

Post by Sir_Cmpwn »

KirinDave wrote: post #119
Sir_Cmpwn wrote: post #110

Earlier quoted context omitted.

I have read the article, several times, thank you very much. Don't take the easy way out by dismissing the opposition as ignorant. >So yeah, there is a reason they didn't do that. The hardware they're using specifically makes it difficult to do the verification you want to do. Which is directly related to foiling the kind of attacks they want to foil. Then they've chosen the wrong hardware. This doesn't make it more…

> Then they've chosen the wrong hardware. This doesn't make it more secure, it just explains why their product is insecure. If the hardware is more resistant to hardware and software attacks, it seems odd to then deem it less secure just because you don't get source code that isn't guaranteed to correspond to a given binary. > reproducable builds There's so much literature on how this methodology fails, some of it qu…

>If the hardware is more resistant to hardware and software attacks, it seems odd to then deem it less secure just because you don't get source code that isn't guaranteed to correspond to a given binary.

It may be, but there's no guarantee it behaves the way it claims to. There's no guarantee it's not backdoored. There are powerful actors involved in these areas.

>There's so much literature on how this methodology fails, some of it quite famous. There is no assurance that your device conforms to the build you can reproduce, unless you can arbitrarily inspect the state of the entire device at each step. Being able to do that would defeat the purpose of these devices.

Care to cite some of this literature?

Post reply on HN