Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting the most out of YubiKeys for your business

blog.congruentlabs.co

Post reply on HN
Print view View original

61–70 of 77 posts

Re: Getting the most out of YubiKeys for your business

#61

Post by GoMonad »

neuralzen wrote: post #35

Actually just started some work on some biometric FIDO2 webapp testing, and there are frustratingly few device options available to use for testing, particularly in linux. It works fine on most modern mobile devices, but I need to get into the guts of things, so I need an actual FIDO2 biometric device so it has been a little frustrating. - I don't suppose anyone knows of any device emulators/simulators our there, to…

The fingerprint reader on my Thinkpad X1 Carbon (gen 7) can work as a FIDO device. I just re-tested it on https://webauthn.io/ with Firefox in Windows 10. I'm guessing other fingerprint readers will too. You need to know that it will be considered a "Platform" device rather than a "Cross platform" device, which is what YubiKeys are considered.

Related but not answering your question: I haven't found any major website that support Platform FIDO devices. I'm guessing they only want 2FA devices which can roam between computers. I think that's unfortunate. Perhaps a good policy would be to allow Platform devices to be used after a Cross Platform device has been registered first. But there are few websites that support multiple FIDO keys to begin with.

How nice would it be to log into websites with your builtin fingerprint reader? The client side stuff seems ready to go.

Re: Getting the most out of YubiKeys for your business

#62

Post by fullstop »

smichel17 wrote: post #59
fullstop wrote: post #54

Earlier quoted context omitted.

I want to get some sort of retractable lead for mine. My keys are heavy-ish and sometimes it can be difficult to get the key in a usb port without tension.

When I had more keys on my keyring I used something like this https://www.amazon.com/Lucky-Line-Keychain-Nickel-Plated-707... (not this particular one, which is just the top result that looked similar). It worked pretty well for a single key, but if you want to use more than one it adds a lot of extra bulk so your keychain gets even bigger. I also tried something like this https://www.amazon.com/Spider-Accessory-Spli…

Thanks! I may try the first one.

Re: Getting the most out of YubiKeys for your business

#64

Post by GoMonad »

m0zg wrote: post #10

Why is there so little competition for these? $50 for a key that maybe costs $5 to manufacture (yes, including software development, at their volume) is a little too rich for my blood.

Adding to the list of alternatives: https://solokeys.com/ Open source hardware

Re: Getting the most out of YubiKeys for your business

#65

Post by smichel17 »

Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

I don't like taking my phone out while I work, since this is often a source of distractions. I also have to worry about keeping it charged and on me (it is much larger than the yubikey). I have to keep the authentication app, which is often proprietary, installed and up to date. I have to worry about retaining access if I lose, break, or want to upgrade my phone. I have to apply a different security model to my phone. I have to trust a third party (duo), and rely on their push notification infrastructure. There is an additional delay while I wait for the push notification.

There is something I intrinsically like about pressing a hardware button.

These are all relatively minor things, but they add up to a strong preference for the yubikey (I've used the simple blue u2f key with a button).

After reflecting on this list, I think the security model is probably the biggest one. In more colloquial terms: I'm already used to keeping track of my keys with a certain amount of care. A yubikey does not require me to adjust my habits; it's just another key.

Re: Getting the most out of YubiKeys for your business

#67

Post by toomuchtodo »

closeparen wrote: post #29
toomuchtodo wrote: post #24

Earlier quoted context omitted.

If you can’t use a phone as a factor, it’s likely you’ll be issued a smart card (such as a CAC in the case of the military). It feels like Yubikeys are a shim until the phone UX as a factor improves (and there’s more server side support) and/or smart card adoption for identity improves. If Touch ID and Face ID are good enough for most secure transactions in the Apple ecosystem (including Apple Pay), seems like a reas…

Some of the U2F-only tokens are their own thing, but the flagship Yubikey is literally a smart card bundled with a reader. The USB token form factor makes a little more sense for an individually assigned laptop.

I have found Yubikey evangelism terribly difficult in both my enterprise and defense industry engagements, hence my smart card statements. For whatever reason, Yubico still has some perception challenges.

Re: Getting the most out of YubiKeys for your business

#68

Post by beagle3 »

jwr wrote: post #34

YubiKeys are absolutely fantastic, and under-rated, too. I used this guide: https://github.com/drduh/YubiKey-Guide to set up my YubiKeys with GPG keys that are also used as SSH keys. This gives me, in a single setup: * secure 2FA for sites with WebAuthN * ability to encrypt backups and other information using GPG, with decryption only possible with a physical device * ability to securely log in via SSH to all my infr…

What kind of baackup do you have in case the yubikey is borked/lost/stolen?

Re: Getting the most out of YubiKeys for your business

#69

Post by justincormack »

m0zg wrote: post #10

Why is there so little competition for these? $50 for a key that maybe costs $5 to manufacture (yes, including software development, at their volume) is a little too rich for my blood.

Yubikey is the competition, before they turned up the equivalent devices were vastly more expensive and less functional.

It is a fairly niche (although growing) market, and you also don't want to buy the cheapest product in the space as it might not work securely.

Re: Getting the most out of YubiKeys for your business

#70

Post by waynesonfire »

i don't like how the yubikey has it's own timeout for passphrases. for example, when i first insert my yubikey, i'm prompted to enter a passphrase to unlock it. it then becomes unlocked until it's removed. this is behavior is not always desired. I'd like the ability to always prompt for a passphrase each time the key is accessed.
Post reply on HN