Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

blog.lessonslearned.org

Post reply on HN
Print view View original

61–70 of 179 posts

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#61

Post by korzun »

I have been using the YubiKey for over a year now, and the novelty wore off.

I lost my key a couple of weeks ago and was surprised how easy it was to get back into my accounts with just my phone. There is no point in using something like that if providers allow you to failover to more conventional authentication methods without any hassle; the keys are useless. They are not going to add manual verification for a couple of people who lost their YubiKey.

YubiKey is useful for instances when you want to grant somebody access to something with just a key. I don't see it going beyond that anytime soon.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#62

Post by swiley »

kasey_junk wrote: post #39
serf wrote: post #22

So, be inconvenienced in every aspects important to a dev but gain a bit of confidence in your machine (as long as you trust Big-G)? verified boot seems like the only advantage here. You can buy an ebay business-grade laptop with TPM for 40 bucks USD readily, and they don't require reliance on Google or the requirement that one uses a neutered OS. (yes, yes, it's secure. It's a users' platform. Development on chrome…

Cloud restore is the other big win here. You don't have to roll your own and it just works . That's why the author has you setup a new account so that you can segment your burner data from your real life.

Syncthing does this for me. I start it, click on one of my other computers, select "introducer" and everything copies back exactly where it was.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#63

Post by swiley »

soniman wrote: post #30
mkohlmyr wrote: post #12

I used my CB30 as a dev machine for a little while, both using cloud environments (koding, codeanywhere) and using vscode under crouton. It is so close to being usable. It is such a user friendly operating system, it just falls short on a few significant fronts. 1. Developer mode should be friendlier to use (no horrible noises on boot, no delayed boot time). 2. It needs support for electron-based/alike apps to run na…

You probably know this but ctrl-d avoids the delay and the noises.

Pressing keys while it's booting up is pretty scary with the threat on the screen to delete everything.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#64

Post by madez »

igravious wrote: post #15
le-mark wrote: post #10

This blog post details using a chromebook as a temporary device, such that you can travel with a blank machine, and provision at your destination with the data and apps you may need: > It's pretty neat to consider the possibility of pre-travel "power washing" (resetting everything clean to factory settings) on an inexpensive Chromebook and later securely restore over the air once at my destination. ... the engineerin…

> Edit; I've been using a de-chromed chromebook for over a year […] Ok, but as the article states, they did not de-ChromeOS it because they wanted TPM and Verified Boot and FIDO-certified U2F security key so that they didn't defeat the whole purpose of buying a Chromebook. FTA: “As far as Debian/Ubuntu (and crouton), that's fine as far as it goes, but then you don't end up with a Chromebook, just a cheap mini-noteboo…

You can have verified boot, and use the TPM and the U2F security key without the chrome os on a chromebook.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#65

Post by Sodman »

I've been running the Chromebook Pixel 2015 as my primary dev machine since it came out. Unlike the author however, I've opted for the less-secure "dev mode" on the laptop, and do everything in crouton. (Java web / Android, mostly).

It may not be as secure, but it's hella convenient (still use 2FA). ChromeOS boot is Everything important on the laptop is backed up to some cloud service or another, but it's expensive enough that I'd be distraught if I lost it (plus they stopped selling them).

I'd be more worried about somebody straight up stealing the laptop than any other security risks I may be running by running in dev mode.

I love the idea of natively developing in ChromeOS, but at this point it just seems like more hassle and fighting the system than it's worth.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#66

Post by g00gler »

Don't do it!

I got a Lenovo 14" IdeaPad N42-20 and desktop to replace my 256gb MacBook Pro.

It turned out to be a bad idea, mostly because the screen is terrible. It's the same resolution as the Samsung 3 mentioned in the article.

It also seems so small compared to a 15". Side-by-side windows isn't very nice, either.

I find myself working less because I don't feel like sitting at my desk or using the Chromebook.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#68

Post by cjsuk »

falcolas wrote: post #59
cjsuk wrote: post #31

Yubikeys tend to wear out your USB ports after a bit I found, at least on my X201 and the X61 that preceded it.

Any port used frequently will wear out - they have limited life spans due to the moving parts. I see it with my external display ports pretty frequently. One potential solution is a USB hub, or even a USB extension cable you keep plugged in.

Or use Duo's mobile app which has no mechanical parts!

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#69

Post by scottLobster »

korzun wrote: post #61

I have been using the YubiKey for over a year now, and the novelty wore off. I lost my key a couple of weeks ago and was surprised how easy it was to get back into my accounts with just my phone. There is no point in using something like that if providers allow you to failover to more conventional authentication methods without any hassle; the keys are useless. They are not going to add manual verification for a coup…

Depends on the provider. From some quick Googling Lastpass at least requires email verification before disabling Yubikey support.

https://lastpass.com/support.php?cmd=showfaq&id=2546

Even for providers that do provide seamless failover, the inevitable "we see you requested an account recovery" email would serve as useful canary to know you're being targeted.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#70

Post by mkohlmyr »

soniman wrote: post #30
mkohlmyr wrote: post #12

I used my CB30 as a dev machine for a little while, both using cloud environments (koding, codeanywhere) and using vscode under crouton. It is so close to being usable. It is such a user friendly operating system, it just falls short on a few significant fronts. 1. Developer mode should be friendlier to use (no horrible noises on boot, no delayed boot time). 2. It needs support for electron-based/alike apps to run na…

You probably know this but ctrl-d avoids the delay and the noises.

I had no idea! As far as I can remember it says any keypress will take you out of developer mode.. I will definitely try this tonight, thanks!
Post reply on HN