Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys
1–10 of 53 posts
Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys
#2I use it with PKCS#11 mode and can't confirm some of the drawbacks the author mentions under Alternatives:
> The UX of this solution is poor: [...] and needs manual reloading every time the YubiKey is unplugged or the machine goes to sleep.
I never have to re-enter the PIN after sleep and can even unplug it for a while to use the port for HDMI output.
Still good to see some work in this space. Native OpenSSH support would be best of course.
Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys
#3Hmm, gpg-agent has worked nicely for me.
The biggest pain is that I have to reconfigure when I switch yubikey.
(Yes, I have multiple keys with the same gpg key on each)
Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys
#4I want to mention a Yubikey alternative that runs on open-source firmware and software: OnlyKey [1]
It has an onlykey-agent that works as an SSH agent [2]. It doesn't work as a GPG agent yet though, they are reportedly working on it.
[1] https://onlykey.io/ [2] https://docs.crp.to/onlykey-agent.html
Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys
#5Hmm, gpg-agent has worked nicely for me. The biggest pain is that I have to reconfigure when I switch yubikey. (Yes, I have multiple keys with the same gpg key on each)
Doesn’t having the same key on multiple devices kinda ruin some of the point of the yubikey? What if you wanted to revoke one after you lost it? Also, how do you store your gpg key? I have a couple yubikeys, but I have different keys on each of them, and I find that works just fine.
Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys
#6I want to mention a Yubikey alternative that runs on open-source firmware and software: OnlyKey [1] It has an onlykey-agent that works as an SSH agent [2]. It doesn't work as a GPG agent yet though, they are reportedly working on it. [1] https://onlykey.io/ [2] https://docs.crp.to/onlykey-agent.html
You may want to read the recent discussion on HN about OnlyKey before using one:
Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys
#7I want to mention a Yubikey alternative that runs on open-source firmware and software: OnlyKey [1] It has an onlykey-agent that works as an SSH agent [2]. It doesn't work as a GPG agent yet though, they are reportedly working on it. [1] https://onlykey.io/ [2] https://docs.crp.to/onlykey-agent.html
You may want to read the recent discussion on HN about OnlyKey before using one: https://news.ycombinator.com/item?id=21884184
Thank you very much for the link, I missed that discussion. I had no idea the security of OnlyKey was so terrible, in light of this I will stop recommending it.
Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys
#8Is it considered good practice to create the key on the yubi and not have a backup? Or alternatively a master key to sign the key on the yubi so you can create a new subkey if you lose the yubi?
Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys
#9I use it with PKCS#11 mode and can't confirm some of the drawbacks the author mentions under Alternatives : > The UX of this solution is poor: [...] and needs manual reloading every time the YubiKey is unplugged or the machine goes to sleep. I never have to re-enter the PIN after sleep and can even unplug it for a while to use the port for HDMI output. Still good to see some work in this space. Native OpenSSH support…
Yeah I had the same experience using OpenPGP applet on the Yubikey both on Linux and Windows. It just works. Maybe it was a problem once but got improved with time?
Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys
#10Hmm, gpg-agent has worked nicely for me. The biggest pain is that I have to reconfigure when I switch yubikey. (Yes, I have multiple keys with the same gpg key on each)
Doesn’t having the same key on multiple devices kinda ruin some of the point of the yubikey? What if you wanted to revoke one after you lost it? Also, how do you store your gpg key? I have a couple yubikeys, but I have different keys on each of them, and I find that works just fine.
It's not a big problem because tokens lock themselves after 3 tries so even if someone got your token they'd have to guess it. Having separate subkeys for each token is nice but works best only with the signature subkey. For encryption it doesn't work as GnuPG encrypts only to one subkey. The same with authentication subkey: it doesn't matter if you revoke it because SSH doesn't understand OpenPGP revocations.