Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Alternatives to Yubikey?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 91 posts

Re: Ask HN: Alternatives to Yubikey?

#51

Post by dom0 »

rbjorklin wrote: post #40
AdmiralAsshat wrote: post #38

Earlier quoted context omitted.

Is...that...safe? I'm all for the a DIY solution, but considering how much of a pickle I'd be in if all of my 2FA tokens were inaccessible, wouldn't the average person want some kind of case or shielding around the exposed board? Give me an enclosure like Samsung's metal flash drives[0], and then I'd be sold. [0] https://www.amazon.com/Samsung-METAL-Flash-MUF-32BA-AM/dp/B0...

The Github page has this to say: "The token should be durable enough to survive on a key chain for years, even after going through the wash." [0] I'd guess covering it all with hot glue would provide sufficient protection. [0] https://github.com/conorpp/u2f-zero/

Hot snot gets icky with time, rather use a conformal coating; they're available in spray-form as well (e.g. CRC Urethan or Plastik 70). That being said FR4 is a really tough material and it's quite difficult to pry SMD parts off.

Re: Ask HN: Alternatives to Yubikey?

#52

Post by makmanalp »

Can some folks also speak to the audit consensus on some of these? It seems with many of the newer / open source solutions, few of the end products actually got audited by a competent external security firm / researcher, right?

Re: Ask HN: Alternatives to Yubikey?

#53

Post by dchest »

dsl wrote: post #11

NitroKey ( https://www.nitrokey.com/ ) is the non-crappy version of YubiKey.

I have two of their U2F and if the OP's problem is sales and support, I'm not really sure Nitrokey are without issues as well:

1) Ordered 2, received 1. Thankfully, support quickly sent the second one once I wrote to them.

2) Now they only work when I plug something else to another port to my Mac (no such problem with Yubikey). No reply since April 29: https://support.nitrokey.com/t/nitrokey-u2f-issues-in-macos-...

Edit: I now noticed they have a different U2F version — the previous one was a card that you fold to make it into a USB dongle.

Re: Ask HN: Alternatives to Yubikey?

#54

Post by chx »

For me, the ideal solution would be a cross platform password manager software which stores your encrypted vault ... somewhere -- I hate the "cloud" word but let's use it -- and then has a small display which the password manager on your phone can read and decrypt the vault with it. It's just a few hundred (thousand at most) bits that you need to carry across, not a big deal. For desktop / laptop / charging, it needs to be USB pluggable. Physical form factor approximately like https://www.adafruit.com/product/2690 this or http://www.ebay.com/itm/Mini-4GB-LCD-Screen-Display-MP3-Musi... this.

The problem currently is a) most sites want passwords b) I do not want to mess with cables c) NFC is not ubiquitous.

Re: Ask HN: Alternatives to Yubikey?

#56

Post by ReAzem »

rst wrote: post #47
dkhenry wrote: post #44

Earlier quoted context omitted.

I use my yubikey and I love it. I have it set up to do GPG, SSH, TOTP, and U2F and it works great. It is worlds better then any other Smart Card or second factor out there, and U2F is literally just plug it in and tap it.

Have you got a writeup of the ssh setup methodology you used? (I've tried scouting around, but not found anything clear yet. Someone's done native support in ssh, but the patch set is hung up on licensing issues and technical quibbles[1], and some of the PAM-based setups seem to require cut-and-paste of crypto strings on every login.) [1] https://bugzilla.mindrot.org/show_bug.cgi?id=2319

I use this:

http://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-ss...

Coupled with a standard yubikey+gpg agent setup

Maybe look at my dotfiles if you are stuck:

- https://github.com/aviau/dotfiles

Re: Ask HN: Alternatives to Yubikey?

#57

Post by atmosx »

dkhenry wrote: post #44
tptacek wrote: post #17

It's worth considering: almost nobody who uses Yubikeys loves them, but they are by a wide margin the tokens experts recommend most.

I use my yubikey and I love it. I have it set up to do GPG, SSH, TOTP, and U2F and it works great. It is worlds better then any other Smart Card or second factor out there, and U2F is literally just plug it in and tap it.

Is there any sort of backup in case it gets destroyed or lost? Can you clone it?

Re: Ask HN: Alternatives to Yubikey?

#58

Post by rst »

ReAzem wrote: post #56
rst wrote: post #47

Earlier quoted context omitted.

Have you got a writeup of the ssh setup methodology you used? (I've tried scouting around, but not found anything clear yet. Someone's done native support in ssh, but the patch set is hung up on licensing issues and technical quibbles[1], and some of the PAM-based setups seem to require cut-and-paste of crypto strings on every login.) [1] https://bugzilla.mindrot.org/show_bug.cgi?id=2319

I use this: http://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-ss... Coupled with a standard yubikey+gpg agent setup Maybe look at my dotfiles if you are stuck: - https://github.com/aviau/dotfiles

Thanks!

Re: Ask HN: Alternatives to Yubikey?

#59

Post by nobodyorother »

atmosx wrote: post #57
dkhenry wrote: post #44

Earlier quoted context omitted.

I use my yubikey and I love it. I have it set up to do GPG, SSH, TOTP, and U2F and it works great. It is worlds better then any other Smart Card or second factor out there, and U2F is literally just plug it in and tap it.

Is there any sort of backup in case it gets destroyed or lost? Can you clone it?

The only backup I know of is getting another key that you register in the same way as the first key.

Hopefully they don't both break at the same time.

Post reply on HN