Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 4C

yubico.com

Post reply on HN
Print view View original

251–260 of 266 posts

Re: YubiKey 4C

#251

Post by homakov »

tptacek wrote: post #189
homakov wrote: post #170

Earlier quoted context omitted.

Get owned = SSH is hikacked = I don't need your keys and can run any commands on your behalf. This thing might protect from keyloggers but useless against proper malware that just waits for you to authenticate.

Like everything, it's useful against some things and not against others. For some people, hardware SSH keys are worth the effort. For others, not.

In my opinion it's not worth the effort (and certainly not $50). It makes marginally +X harder to exploit yet marginally +X inconvenient to use = typical security through obscurity.

Re: YubiKey 4C

#252

Post by pmoriarty »

drewg123 wrote: post #66
baccredited wrote: post #11

Do any of these RSA alternatives have an LCD display showing the id? Our work computers are locked down and USB is not an option.

The OTP functions basically as a USB HID keyboard. So you can plug it into something that is not locked down (like a phone or tablet), and then just copy the code. The drawback is that the code could be long . A few years ago, the codes were just 6 digits. My latest nano spits out a very long (20 char?) alpha-numeric string.

I wouldn't mind a 20 char string. I regularly type passphrases significantly longer than that.

Re: YubiKey 4C

#253

Post by jupp0r »

homakov wrote: post #251
tptacek wrote: post #189

Earlier quoted context omitted.

Like everything, it's useful against some things and not against others. For some people, hardware SSH keys are worth the effort. For others, not.

In my opinion it's not worth the effort (and certainly not $50). It makes marginally +X harder to exploit yet marginally +X inconvenient to use = typical security through obscurity.

what makes it attractive to me is that it's actually much more convenient to use than a password.

Re: YubiKey 4C

#254

Post by moreentropy »

nickik wrote: post #220
moreentropy wrote: post #86

Earlier quoted context omitted.

TOTP with Yubikeys is great. You just need the Yubico Authenticator app to access the TOTPs. Works fine on phone using NFC as well as on my (Linux) desktop using USB. New phone? Install YK Authenticator, tap the YK and use your TOTPs.

How do you do TOTP on linux with your Yubikey? I keep using my phone.

Yubico Authenticator for Desktop:

https://www.yubico.com/support/knowledge-base/categories/art...

If you're on Ubuntu you can use the package yubioath-desktop from this PPA:

https://launchpad.net/~yubico/+archive/ubuntu/stable

Re: YubiKey 4C

#255

Post by homakov »

jupp0r wrote: post #253
homakov wrote: post #251

Earlier quoted context omitted.

In my opinion it's not worth the effort (and certainly not $50). It makes marginally +X harder to exploit yet marginally +X inconvenient to use = typical security through obscurity.

what makes it attractive to me is that it's actually much more convenient to use than a password.

It really is, but there is no need for hardware. Software based auth would be the same

Re: YubiKey 4C

#256

Post by esseti »

nickik wrote: post #222
esseti wrote: post #91

I've a yubikey4 but i'm not sure how/why i should use it. I get the 2FA case, where it provides the One Time Password to login in some services, sort of what the phone does with the authy app (or am I wrong?). But, what about the ssh access? Should the key be used to decrypt the ssh key when accessing a server? so that, if i grab anycomputer i can login on my server if I've the yubikey with me? if so, how should this…

I use it for lots of stuff. Lets go threw it. Yubikey supports a number of different 2FA workflows. It supports TOTP (together with a phone), HOTP, Yubico OTP (that is there own standard based on HOTP) and of course most importantly U2F. U2F the new and improved 2FA standard that gives you interesting things like phishing protection. It can also be used to issue a static password, and it can also be used in a Challan…

I wrote to you via the keybase tool. I've setted up the yubikey, copy the Access Key to the yubikey but the ssh-add -L does not list the key from the yubikey

Re: YubiKey 4C

#257

Post by StavrosK »

nickik wrote: post #208
StavrosK wrote: post #102

Earlier quoted context omitted.

Does anyone have a guide on how to store an SSH key on it? I only found PGP key guides (and I have my key on it), but not much for SSH. I also think it doesn't do ECC...

Yes. You have to check out the PIV module. It can even be used as a CA. https://developers.yubico.com/PIV/Guides/ There are a number of tools you can install yubico-piv-manager/yubico-piv-tool but check the guides. I had some problems with this, somehow I could not add the key to ssh-agent, but that was related to the ssh-agent, not sure its a general problem. Note, this does only support 2k keys. If you use the GPG…

Thank you, this is the best guide I've seen so far. It's much simpler to install and use. However, like you, I'm having some problems. Adding the key to the ssh-agent asks for a PKCS password and always comes back with "agent refused cooperation". I also can't log in to a host that has that SSH key, but maybe that's because I have too many keys loaded...

EDIT: Never mind, it works perfectly, thanks!

Re: YubiKey 4C

#258

Post by IgorPartola »

ci5er wrote: post #198
IgorPartola wrote: post #195

Earlier quoted context omitted.

My problem is that while I can reasonably guarantee that my YubiKey will be near my laptop when I use it, I generally can't guarantee that my YubiKey will be near my phone or tablets when I use them. I also don't really want to keep plugging in a physical key into my phone every time I want to log into, say, American Airlines to check the status of my flight, or into PapaJohns.com every time I want to order a pizza.…

Makes sense. Thanks. It seems as if what I would consider "natural usage" is a bit different than yours. I don't use my phone to access anything critical -- the attack surface is too big and changes too rapidly (sometimes outside of my control) for me to keep track of -- and I wouldn't worry about safety when checking a flight.

I consider most things critical. I treat my dating profile or my HN credentials the same way I treat me main email account's credentials.

Re: YubiKey 4C

#259

Post by tptacek »

homakov wrote: post #251
tptacek wrote: post #189

Earlier quoted context omitted.

Like everything, it's useful against some things and not against others. For some people, hardware SSH keys are worth the effort. For others, not.

In my opinion it's not worth the effort (and certainly not $50). It makes marginally +X harder to exploit yet marginally +X inconvenient to use = typical security through obscurity.

You've lost me at "security through obscurity".

Re: YubiKey 4C

#260

Post by bb88 »

nhf wrote: post #98
bb88 wrote: post #57

Earlier quoted context omitted.

The U2F zero was on amazon for a while. But not anymore. Unfortunately the guy who is doing it no longer has time for it.

If you're feeling crafty, you can create your own: https://github.com/conorpp/u2f-zero/wiki/Building-a-U2F-Toke...

No. I'm not. That's why I bought mine on amazon. :)
Post reply on HN