Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 4C

yubico.com

Post reply on HN
Print view View original

131–140 of 266 posts

Re: YubiKey 4C

#131

Post by danjoc »

tptacek wrote: post #64
hollander wrote: post #41

I have a Yubikey, but almost never use it. I still don't get it fully, don't have a use-case where it totally works for me. Having one key is maybe part of the problem. If I lose it, what then?

Some people will tell you to buy two Yubikeys and leave one as a backup. I don't think that's necessary. No matter what, you should generate a backup software key and keep it on offline encrypted storage; if you lose the token, just use the backup key until your replacement arrives. It's even easier for Github and Google Mail. For web services, the right stack is: * Hardware U2F token * Backup software TOTP (Duo or G…

Can you disable SMS on google? I've tried and have been unsuccessful. Phone is required to enable 2FA. Once that is enabled, I can add yubikeys. After adding yubikeys, I am unable to remove phone as a 2FA alternative.

Re: YubiKey 4C

#132

Post by lytedev »

escapologybb wrote: post #120

I REALLY wish it were possible to use one of these devices without using your hands. I'm quadriplegic and would love to use one of these to unlock my computer, bank passwords etc etc. But you have to touch a finger to almost all of them to trigger the OTP, or whichever authentication and they happen to be using. I would absolutely love to be able to lock and unlock my Mac without an able-bodied person helping me, bec…

Why not run an operating system that does let you use accessibility software at the login screen?

Re: YubiKey 4C

#133

Post by ilyaeck »

escapologybb wrote: post #120

I REALLY wish it were possible to use one of these devices without using your hands. I'm quadriplegic and would love to use one of these to unlock my computer, bank passwords etc etc. But you have to touch a finger to almost all of them to trigger the OTP, or whichever authentication and they happen to be using. I would absolutely love to be able to lock and unlock my Mac without an able-bodied person helping me, bec…

Technically, this could/should have been already solved with voice authentication. Nuance and other companies have been claiming/pushing it for a few years now: http://www.nuance.com/for-business/customer-service-solution.... I'd actually expect Apple to be the first big player to incorporate that, as they've been a leader in accessibility. Maybe somebody should sue them for discrimination to accelerate the process.

Re: YubiKey 4C

#134

Post by lorenzhs »

chrisacky wrote: post #89

I bought a HyperFido but it just doesn't work on Ubuntu... Was expecting to be able to use it to log in to Google using their 2FA key.. but only works on Windows from what I can see... Anyone know anything about this?

You're probably missing some library or other. I know I had to install something in debian unstable, but I don't remember what it was. U2F definitely works on Linux, though.

Re: YubiKey 4C

#135

Post by abhv »

Freak_NL wrote: post #24
abhv wrote: post #19

alternative is u2fzero, available on amazon for 8$, and totally open source. the difference is that yubi uses an nxp secure coprocessor, whereas the u2fzero uses atmel. there is the possibility of side-channel attacks on the u2fzero. but for your family, it is better than nothing and much more cost effective.

> […] there is the possibility of side-channel attacks on the u2fzero. Interesting. How does that work? Have you any references to that?

The Atmel chips do not claim that they have implemented counter-measures for power analysis, etc. Power analysis on a key operation is a dangerous attack if proper counter-measures are not taken. You can literally read off the 0/1 of each bit of the key as the key operation is underway if you monitor the power/timing.

The NXP chips inside the yubikey claim to be hardened against several such attacks (although I have not confirmed).

NXP is a cagey company. For example, I am a researcher, and I wanted to get the yubi-key's unlocked to write and test new u2f protocols on their hardware. They wouldnt sell me development keys, and claimed that the restriction was placed on them by NXP. I wrote half-a-dozen requests to the NXP people, and they never replied.

Re: YubiKey 4C

#136

Post by avenoir »

So I got one 4 months ago and quickly found out that I understand next to nothing about it. I really thought it was going to be a plug-n-play solution but it was far from it. It took me nearly an hour to get my google account setup to use it. For some reason the little wizard thing on Google that "syncs" your yubikey was giving me trouble. After I finally got that part working i pretty much forgot about the whole thing. I had plans to also use it with KeePass in addition to Google but after reading that you basically have to hack this thing to work with both I pretty much decided it wasn't worth the effort. It's really sad how great this little thing is and how much of a pain it is to actually get any use out of it.

Re: YubiKey 4C

#137

Post by lorenzhs »

Sir_Cmpwn wrote: post #81
Filligree wrote: post #62

Earlier quoted context omitted.

Any suggestions?

Just use a TOTP app, at the moment. Note that because there are no U2F alternatives means that you shouldn't use U2F - not that you should settle for an insecure device.

There are U2F alternatives, several of which are mentioned in this thread. Also, U2F is immune to phishing while TOTP isn't. Your advice is actively harmful.

Re: YubiKey 4C

#138

Post by tptacek »

danjoc wrote: post #131
tptacek wrote: post #64

Earlier quoted context omitted.

Some people will tell you to buy two Yubikeys and leave one as a backup. I don't think that's necessary. No matter what, you should generate a backup software key and keep it on offline encrypted storage; if you lose the token, just use the backup key until your replacement arrives. It's even easier for Github and Google Mail. For web services, the right stack is: * Hardware U2F token * Backup software TOTP (Duo or G…

Can you disable SMS on google? I've tried and have been unsuccessful. Phone is required to enable 2FA. Once that is enabled, I can add yubikeys. After adding yubikeys, I am unable to remove phone as a 2FA alternative.

Yes: delete your phone number.

Re: YubiKey 4C

#139

Post by dschep »

unicornporn wrote: post #129
dgacmu wrote: post #115

Earlier quoted context omitted.

I can confirm that the NFC support works (yubikey neo with a nexus 5x) - but very few applications and sites support it.

Do you know if it will work with a 5X running Copperhead OS (no gapps)? Ie. is the apk available?

It's on F-Droid, so probably: https://f-droid.org/repository/browse/?fdfilter=yubico&fdid=...

Re: YubiKey 4C

#140

Post by pdpi »

artursapek wrote: post #61
Freak_NL wrote: post #20

Earlier quoted context omitted.

Apple decided that users cannot use the NFC chip in it except for Apple Pay (for the foreseeable future). You don't really 'own' an Iphone in that sense.

Seriously?

Yup.

That said, Apple doesn't advertise the iPhone as having NFC. It's just an implementation detail for the features they do advertise.

Post reply on HN