Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 4C

yubico.com

Post reply on HN
Print view View original

211–220 of 266 posts

Re: YubiKey 4C

#211

Post by nickik »

rogerbinns wrote: post #104
ionised wrote: post #25

What are the current alternatives to Yubikey? Preferably looking for something open-source and in no way associated with Google.

I haven't used it, but Trezor looks interesting, and there is a Trezor 2 coming soon. https://trezor.io/ The sweet spot is for Bitcoin wallets, but it does the other stuff (U2F, ssh, gpg, passwords). Hardware is interesting. Everything open source. You can add your own "apps". U2F: https://blog.trezor.io/secure-two-factor-authentication-with...

I use both this and Yubikeys.

The external screen add even more security and that is very cool. UAF/U2F both have support for external monitors in the protocol, so its really good security.

The ssh/gpg stuff is less advanced then that of the Yubikey, all guides suggest running some special scripts. With the Yubikey you can set it all up so this is not needed. Maybe this works with the Trezor, but I didn't find any guides for this.

I really want Trezor to support UAF as well, given that it has a PIN entry system, this should work.

If you need a Bitcoin Wallet, Trezor is cool, if you want a tool primary for login (U2F/OTP/TOTP), a Yubikey is preferable.

Re: YubiKey 4C

#212

Post by zhengyi13 »

escapologybb wrote: post #159
zhengyi13 wrote: post #149

Earlier quoted context omitted.

I'm reminded of the brief experiences I had w/ Greg Priest Dorman and his physical computing setup, which had him attaching keyboards to his hands, and displays to his glasses. This is a really hacky/bespoke idea, and I apologize if I'm being naive, but I wonder if you might be able to string a Yubikey Nano ( https://www.yubico.com/product/yk4nano/ ) via a USB extension cable to someplace accessible to you around you…

I thought of this when the Yubikey first came out, but apparently it needs to be your finger that makes the connection. I'm not sure if that's still the case, because like you I just assumed I could extend the key somewhere around my chin controller and then use the tip of my nose to activate the key. I believe the tip of your nose is actually fairly unique FYI. But yes, that would be one solution and great minds thi…

The Nano at least is not fingerprint-based; it's simply a capacitance thing - any conductive thing touching it, connected to you, will be treated as a touch. I have at least one coworker who strung paperclips from their Nano to someplace convenient, and they just touch the paperclip.

As well, I just performed a test by rubbing my nose on my Nano, and it worked as intended :)

Re: YubiKey 4C

#214

Post by nickik »

LeifCarrotson wrote: post #34
jupp0r wrote: post #22

Until there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats the whole point.

> Not having it inserted defeats the whole point How so? I would keep this on a keychain or lanyard (it looks rugged enough to handle that sort of environment). When I need to authenticate, I plug it in, when I'm done, I unplug it. That seems a lot more secure than leaving it in the computer all the time. If someone gets my computer and the YubiKey is always installed, that sort of defeats the purpose of having a sep…

Direct physical access to your computer is not the only thread. Even if you have in your computer all the time it gives you better logins, easier and safer. Specially protection from phishing.

When I leave my computer out of my eyes it usually locked (unlock with password), so I don't expect somebody to quickly go in and do something. If I leave for longer, I sometimes pull the Nano out and put it somewhere I don't lose it for a while.

The advantage of your system is that you can use the U2F screen unlock instead of the password.

Re: YubiKey 4C

#215

Post by platz »

bb88 wrote: post #69
tptacek wrote: post #58

Note that this isn't just a U2F key; if you're looking for a token principally to log into web services with, this isn't what you want, and the token that does that costs less than half as much (it's the U2F-only token). You want a Y4 if: * You SSH into sensitive machines. * You log into a VPN that you control and can configure to use the Y4. * You're actually relying on PGP.

Bitcoin wallet security. That's the next big thing.

what happens when you lose your yubikey? Has anyone ever lost their keys?

Re: YubiKey 4C

#216

Post by nickik »

mstade wrote: post #84
ionised wrote: post #25

What are the current alternatives to Yubikey? Preferably looking for something open-source and in no way associated with Google.

Wait – Yubikey is associated with Google? Or did you mean that whatever alternatives people suggest mustn't be associated with Google?

There are some connections. The people who founded it. Google are early investors. Google are also one of the most important costumers.

I think that makes it even more secure. Google house lots of people running around with these.

Re: YubiKey 4C

#217

Post by nickik »

homakov wrote: post #170
tptacek wrote: post #73

Earlier quoted context omitted.

Your computer can in theory get owned up without you losing your SSH or VPN keys, even if your keystrokes are logged.

Get owned = SSH is hikacked = I don't need your keys and can run any commands on your behalf. This thing might protect from keyloggers but useless against proper malware that just waits for you to authenticate.

If your SSH private key is on the Yubikey then you will not lose your private keys. Even in the case of U2F, the attacker will not figure out your U2F private keys or even all the places you are registered.

Re: YubiKey 4C

#218

Post by herpderperator »

IgorPartola wrote: post #96

Until these things work well with phones, I can't buy into them. I have a U2F key that I use as a shortcut for accessing things like Google's services. But I am sticking to always using either Google Authenticator or SMS, if it's available, as a primary option. When I am looking at a website in bed on my phone, and my YubiKey is in my laptop downstairs, I can't say I am happy that I can't access my account. I think t…

I use the Yubikey Neo with my phone via NFC to unlock my master password database which I use KeePass for. I wear my Yubikey on my necklace, tucked under my shirt and never remove it (it's waterproof, I shower with it.) I type my master password and just tap my phone to my chest to unlock.

Re: YubiKey 4C

#219

Post by nickik »

jgrahamc wrote: post #3

Why are Yubikeys so expensive? I have one and use them but the price always gets in the way of having more.

They do lots of stuff. A YubiKey 4 has GPG Smartcard, U2F, PIV (SSH,CA, Windows Remote Login), Static Password, Yubikey OTP, Challenge Response Mode (HMAC) and HOTP. It does a lot of stuff, I am amazed how cheap they are.

Pure U2F sticks can be done much cheaper. The Yubikey one only costs 18$, but the U2F standards was designed for cheap devices. You can get U2F sticks for less then 10$ on amazon.

Re: YubiKey 4C

#220

Post by nickik »

moreentropy wrote: post #86
tptacek wrote: post #68

Earlier quoted context omitted.

Annoying nerd pedantry: It's only sort of doing TOTP (Yubikeys don't have batteries, so need a software client to provide the clock), and on a slack with almost 300 crypto nerds in it, I don't know any of them that use the Y4 for TOTP (I'm preparing myself to be surprised in a minute when someone there reads this). TOTP is something you do on your phone.

TOTP with Yubikeys is great. You just need the Yubico Authenticator app to access the TOTPs. Works fine on phone using NFC as well as on my (Linux) desktop using USB. New phone? Install YK Authenticator, tap the YK and use your TOTPs.

How do you do TOTP on linux with your Yubikey? I keep using my phone.
Post reply on HN