Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 4C

yubico.com

Post reply on HN
Print view View original

221–230 of 266 posts

Re: YubiKey 4C

#221

Post by nickik »

tptacek wrote: post #68
buddylw wrote: post #47

I don't think that the people complaining about the price of this key appreciate all that it can do. Most of those people would probably be better off with the cheaper FIDO U2F Security Key. I haven't found anything else that manages RSA Keys, TOTP auth and U2F in a single package. I'm going to buy this because it plugs into my pixel phone and it seems like it'd be more secure and convenient than my current Neo with…

Annoying nerd pedantry: It's only sort of doing TOTP (Yubikeys don't have batteries, so need a software client to provide the clock), and on a slack with almost 300 crypto nerds in it, I don't know any of them that use the Y4 for TOTP (I'm preparing myself to be surprised in a minute when someone there reads this). TOTP is something you do on your phone.

In addition to what the others have said, I would point out that TOTP with the Yubikey/Yubico Authenticator has one other advantage. You can move between different android devices without problem. Its even nicer then Cloud-based Authy.

I was in a pinch once and had to do TOTP, so I grabbed the phone of my friend, downloaded the app and used it to log in.

Re: YubiKey 4C

#222

Post by nickik »

esseti wrote: post #91

I've a yubikey4 but i'm not sure how/why i should use it. I get the 2FA case, where it provides the One Time Password to login in some services, sort of what the phone does with the authy app (or am I wrong?). But, what about the ssh access? Should the key be used to decrypt the ssh key when accessing a server? so that, if i grab anycomputer i can login on my server if I've the yubikey with me? if so, how should this…

I use it for lots of stuff.

Lets go threw it. Yubikey supports a number of different 2FA workflows. It supports TOTP (together with a phone), HOTP, Yubico OTP (that is there own standard based on HOTP) and of course most importantly U2F. U2F the new and improved 2FA standard that gives you interesting things like phishing protection.

It can also be used to issue a static password, and it can also be used in a ChallangeResponse mode (you send something it and it will get hashed). Both of these can be used to do decryption while booting for example.

Now lets get to the more advanced stuff. Yubikey is both a GPG Smartcard and a PIV Smartcard. Essentially this allows you plug in your Yubikey and then automatically your GPG and SSH keys will appear as if they are on the system. If your program, for example Thunderbird or SSH, tries to use the private key, it will require a PIN.

This allows you to have no key material on your computer. If you are hacked the attacker has no access to your private keys (and hopefully thanks to 2Fa not to many of your accounts). Even if you lose the keys themselfs your keys will probably not leak.

Depending on your situation and security needs you will want this stick either always plugged in your machine, or you want to carry a stick around on your keychain.

As for how to set it up, Yubico has lots of documentation.

https://developers.yubico.com/

If you have questions, you have my keybase :)

Re: YubiKey 4C

#223

Post by nickik »

danjoc wrote: post #131
tptacek wrote: post #64

Earlier quoted context omitted.

Some people will tell you to buy two Yubikeys and leave one as a backup. I don't think that's necessary. No matter what, you should generate a backup software key and keep it on offline encrypted storage; if you lose the token, just use the backup key until your replacement arrives. It's even easier for Github and Google Mail. For web services, the right stack is: * Hardware U2F token * Backup software TOTP (Duo or G…

Can you disable SMS on google? I've tried and have been unsuccessful. Phone is required to enable 2FA. Once that is enabled, I can add yubikeys. After adding yubikeys, I am unable to remove phone as a 2FA alternative.

I was also unable to do this, but I tried earlier today and it worked.

You have to have TOTP and Backup keys. Maybe this is a recent change.

Re: YubiKey 4C

#224

Post by tptacek »

nickik wrote: post #217
homakov wrote: post #170

Earlier quoted context omitted.

Get owned = SSH is hikacked = I don't need your keys and can run any commands on your behalf. This thing might protect from keyloggers but useless against proper malware that just waits for you to authenticate.

If your SSH private key is on the Yubikey then you will not lose your private keys. Even in the case of U2F, the attacker will not figure out your U2F private keys or even all the places you are registered.

His point, which is correct, is that you'll persistently lose access to your server anyways, because a backdoored SSH client is almost as bad as a compromised key. I use a Y4 for SSH, but it's good to be clear-eyed about the limitations.

Re: YubiKey 4C

#225

Post by nickik »

johnnycarcin wrote: post #56
hollander wrote: post #41

I have a Yubikey, but almost never use it. I still don't get it fully, don't have a use-case where it totally works for me. Having one key is maybe part of the problem. If I lose it, what then?

I'm in the same boat and actually submitted an "Ask HN" awhile back to see what others were doing ( https://news.ycombinator.com/item?id=13567209 ). I have the plain ol' yubikey and also the NFC yubikey but I haven't found a good, real world use case for them. It might be that I'm just not the target market or that I haven't put enough time/effort into it. For me the big selling point was the FIDO stuff but so few pr…

Check out some of my last answers in this thread. I use it for:

U2F (Google, Dropbox, Facebook, Github, Bitbucket), TOTP (Slack and everybody else that does not support U2F), Yubikey OTP (LastPass), static password for luks decryption (additionally to normal password), GPG Smartcard

The only feature Im not yet using is the PIV SSH stuff.

I also just like hitting the button and printing out OTPs when Im boarded.

Re: YubiKey 4C

#226

Post by Florin_Andrei »

feedjoelpie wrote: post #209
Florin_Andrei wrote: post #186

Earlier quoted context omitted.

It depends on the device, but if it's a regular capacitance sensor, what's really needed is just some mildly conductive object touching the sensor - something akin to a human finger. Does not have to be personalized, since this is not a fingerprint sensor. I have an older Yubikey stashed somewhere - if I can unearth it, I'll do some tests. But I suspect it could be something as simple as a wire: on one end touching t…

I had a Nano. I'm like 99% sure all the GP would have to do is tie a wire to the metal tab, and then he could bump the other end of the wire with any part of his body.

You're probably right.

Re: YubiKey 4C

#227

Post by nobodyshere »

Freak_NL wrote: post #20
NikolaNovak wrote: post #14

Do they work any better on iPhones? ----- I decided couple of months ago to secure entire family. Bought half dozen Neos, worked out all the kinks on my computer + Android phone first, put everything in LastPass (I know, I know, I know... but you have to consider the target audience ;).... only to discover on "go-live" that my wife's iPhone 6s is bloody useless with the thing. Apparently iPhone doesn't fully grok NFC…

Apple decided that users cannot use the NFC chip in it except for Apple Pay (for the foreseeable future). You don't really 'own' an Iphone in that sense.

Actually they can. Features are being added, for example using iphone's nfc chip as a work pass.

Re: YubiKey 4C

#228

Post by nickik »

chrisacky wrote: post #89

I bought a HyperFido but it just doesn't work on Ubuntu... Was expecting to be able to use it to log in to Google using their 2FA key.. but only works on Windows from what I can see... Anyone know anything about this?

Probably a udev problem, you need:

https://developers.yubico.com/libu2f-host/

or maybe even better:

https://github.com/amluto/u2f-hidraw-policy

On the Yubikey its also possible to deactivate individual modes. If somehow U2F mode was disabled, it should not work anywhere, but if you don't use the other modes, maybe deactivate them. In earlier version there were some problems.

Probably its the first one.

Re: YubiKey 4C

#229

Post by nickik »

tckr wrote: post #16

Make the price $5 and these will sell.

These keys will never be $5 but pure U2F only keys are almost already there. You can get U2F keys for 8-10$ already.

Re: YubiKey 4C

#230

Post by [deleted] »

amichal wrote: post #42
Nullabillity wrote: post #15

Kind of useless to have a C-only device this early. An A/C-hybrid would be much more useful, like Kingston's MicroDuo[1] series. [1]: http://www.kingston.com/us/usb/personal_business/DTDUO3C

..or from YubiKey for 1$ more (then their USB c version) https://www.yubico.com/product/yubikey-4-nano-usbc-bundle/

[deleted]
Post reply on HN