Here's my hands-on review with the new YubiKey 4C: https://news.ycombinator.com/item?id=13637771
YubiKey 4C
181–190 of 266 posts
Re: YubiKey 4C
#182Re: YubiKey 4C
#183I still don't get how people are ok using these things without a fingerprint reader...
I've probably posted this a dozen times, but Dustin Kirkland (the Linux encryptfs maintainer) so eloquently put it that fingerprints (and all biometrics) make wonderful usernames, and horrible passwords:
http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...
Re: YubiKey 4C
#184Earlier quoted context omitted.
Some people will tell you to buy two Yubikeys and leave one as a backup. I don't think that's necessary. No matter what, you should generate a backup software key and keep it on offline encrypted storage; if you lose the token, just use the backup key until your replacement arrives. It's even easier for Github and Google Mail. For web services, the right stack is: * Hardware U2F token * Backup software TOTP (Duo or G…
Can you disable SMS on google? I've tried and have been unsuccessful. Phone is required to enable 2FA. Once that is enabled, I can add yubikeys. After adding yubikeys, I am unable to remove phone as a 2FA alternative.
You need a software token (Google Auth) or backup codes before removing the phone number.
Re: YubiKey 4C
#185Earlier quoted context omitted.
The available data suggests there are no groups of people who are good at not being phished. The audience here is unlikely to send a check to the Nigerian prince looking to smuggle his money to America, but if you're arguing that we shouldn't trust yubikeys against APT backdoors, we're talking about a much higher quality of phishing. I'll take my odds with yubikeys firmware rather than try to vet every site I enter a…
You should be vetting those sites anyway, especially since you probably were also asked for a password. And it's not exactly hard - just glance up at the address bar. >The available data source?
A good phish relies on triggering instinctive behaviour, e.g. scaring the crap out of you and not following best practices because you're having an adrenaline rush. That's how careful people get hit. SwiftOnSecurity sometimes posts really well done phishing attempts: https://twitter.com/search/live?q=phish+from%3Aswiftonsecuri...
Re: YubiKey 4C
#186Earlier quoted context omitted.
Since it's a capacitive touch device, you really just need something conductive to touch the pad and connect it to "ground". Maybe someone you know could take the yubikey device, attach a wire to it, then connect up a relay or something that could be controlled (using whatever interface you already have - I'm not that familiar with such medical devices) to activate the relay. When the switch contacts close, the other…
Thanks for the links, they look really useful and it's only just occurred to me when you pointed it out that when a person such as the key they are completing a circuit. If I could do that in someway that could be unique to me, then that might just be possible to do. I just need to find somebody to do the soldering!. :-)
It depends on the device, but if it's a regular capacitance sensor, what's really needed is just some mildly conductive object touching the sensor - something akin to a human finger. Does not have to be personalized, since this is not a fingerprint sensor.
I have an older Yubikey stashed somewhere - if I can unearth it, I'll do some tests. But I suspect it could be something as simple as a wire: on one end touching the computer's ground circuit, while at the other coiled up to make a flat spiral the size of the sensor, and having that touch the sensor. The wire could probably be isolated, because the sensor is based on capacitance, so it does not require a full circuit.
A simple way to get a ground connection to the computer is via a fake USB connector. Pin #4 is ground.
http://www.hobbytronics.co.uk/usb-connector-pinout
Or perhaps the outer metal jacket of the USB connector would also get a ground connection.
With a Mac laptop, maybe it's enough to just touch the metallic case to get a ground connection.
TLDR: A wire, connected to computer's ground at one end, with a little metal pad (or flat coil) at the other. Bring the pad close enough to the sensor, and it should trigger.
Re: YubiKey 4C
#187Until these things work well with phones, I can't buy into them. I have a U2F key that I use as a shortcut for accessing things like Google's services. But I am sticking to always using either Google Authenticator or SMS, if it's available, as a primary option. When I am looking at a website in bed on my phone, and my YubiKey is in my laptop downstairs, I can't say I am happy that I can't access my account. I think t…
They do work with phones. I have an iPhone with a Lightning-Camera (USB) adapter and use it all the time.
Unfortunately, not for U2F though
Re: YubiKey 4C
#188Earlier quoted context omitted.
Since it's a capacitive touch device, you really just need something conductive to touch the pad and connect it to "ground". Maybe someone you know could take the yubikey device, attach a wire to it, then connect up a relay or something that could be controlled (using whatever interface you already have - I'm not that familiar with such medical devices) to activate the relay. When the switch contacts close, the other…
Thanks for the links, they look really useful and it's only just occurred to me when you pointed it out that when a person such as the key they are completing a circuit. If I could do that in someway that could be unique to me, then that might just be possible to do. I just need to find somebody to do the soldering!. :-)
Not sure exactly what you have in mind, but it's possible that there's a misconception here about how these devices work. They don't depend on the touch being "unique to you" -- as mentioned above, it's just looking for a capacitive connection. The extra security they give is linked to the fact that an unauthorized user would be less likely to have access to the device itself.
Also, most implementations of security with yubikey-type devices I've seen use it as a secondary authentication mechanism and still require a password, so it wouldn't actually solve your original issue of hands-free access. :( There may be ways to configure it to be the sole means of authentication though.
Re: YubiKey 4C
#189Earlier quoted context omitted.
Your computer can in theory get owned up without you losing your SSH or VPN keys, even if your keystrokes are logged.
Get owned = SSH is hikacked = I don't need your keys and can run any commands on your behalf. This thing might protect from keyloggers but useless against proper malware that just waits for you to authenticate.
Like everything, it's useful against some things and not against others. For some people, hardware SSH keys are worth the effort. For others, not.
Re: YubiKey 4C
#190Earlier quoted context omitted.
They have a NFC yubikey available, and most new phones work with USB-C (which this one has)
I can confirm that the NFC support works (yubikey neo with a nexus 5x) - but very few applications and sites support it.
I use the NFC Yubikey to store a PGP key, which can then be used with pass [1] + GPG on the desktop, and Password Store + OpenKeychain on Android. Works nicely. And if you choose to also keep the PGP key on the desktop, you don't need to carry the Yubikey.