Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A virtual Yubikey device for 2FA/WebAuthN

github.com

Post reply on HN
Print view View original

71–80 of 143 posts

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#71

Post by pabs3 »

jrm4 wrote: post #64

So, curious. Anyone here do what I do, a simple encrypted Linux volume + "oathtool" powered script? Yeah, I know, same device, blah blah. I'm still pretty comfortable with it and I just don't like having this stuff on my phone, which perpetually feels less safe.

I do something similar with pass, pass-otp and browserpass. Looking forward to using virtual-fido because I do not want non-free hardware keys.

https://github.com/browserpass/ https://github.com/tadfisher/pass-otp https://www.passwordstore.org/

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#73

Post by pabs3 »

cmdli wrote: post #37
askvictor wrote: post #24

Wouldn't this reduce security considerably, for the scenario where the computer is compromised?

Author here. The credentials are encrypted on-disk with a passphrase, so it wouldn't be trivial extract them, but yes it would be somewhat less secure than a hardware device. I would consider it similar in security to a local password manager. (Note: this software is in beta so I wouldn't yet use it for significant security operations) Personally, part of the motivation for creating this was to find a middle ground b…

I hear that Apple is creating "passkeys" which are essentially what you have created; FIDO/WebAuthN that is implemented in software and are even syncable into the cloud.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#74

Post by [deleted] »

nick__m wrote: post #54
iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

I use 1Password and 2 Yubikey. Both yubikeys are configured to enter the same impossible to memorize password on a press to unlock 1Password, hid mode is supported by every device with a USB ports. I also use them as an otp second factor when a site requires it. Finally, they are configured with a x509 certificate that I use as my ssh keys. I generate one key per devices that way the secret never leaves it and I requ…

[deleted]

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#75

Post by iudqnolq »

akerl_ wrote: post #45
iudqnolq wrote: post #27

Earlier quoted context omitted.

I'd love to have that setup. The only problem is insufficiently mature support for the devices I use, Linux and Android. As I mentioned in an edit Yubikey local auth on Linux relies on a personal GitHub project abandoned years ago.

The other person who replied to this seems to have gotten up on the wrong side of the bed, but the core of their suggestion is one I’d likewise recommend. I’m doing the yubikey local auth using the yubikey’s PIV applet, which holds standard x509 certs that can be used via pkcs11. You should be able to set up PAM to use them in that way, without needing any yubikey-specific hijinks. Something like https://discourse.ub…

Thanks!

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#76

Post by InvaderFizz »

turdnagel wrote: post #70
nick__m wrote: post #54

Earlier quoted context omitted.

I use 1Password and 2 Yubikey. Both yubikeys are configured to enter the same impossible to memorize password on a press to unlock 1Password, hid mode is supported by every device with a USB ports. I also use them as an otp second factor when a site requires it. Finally, they are configured with a x509 certificate that I use as my ssh keys. I generate one key per devices that way the secret never leaves it and I requ…

Can you use the Yubikey as a keyboard on iOS?

Not sure if this answers your question, but you can use a Yubikey for FIDO2 on iOS with any iOS device with a USB port, or use the camera connection kit to make one on a Lightning port device.

Source: I was curious, so I used a camera connection kit to login to Okta with a Yubikey as my MFA last month.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#77

Post by Lucent »

crazysim wrote: post #30

I'm guessing this won't work for sites where a real device is mandated. I believe on Vanguard, they were enforcing only permitting real Yubikey devices with real Yubikey certificates.

They'll also accept Android phones via Bluetooth. More importantly, adding two keys lets you disable SMS codes.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#78

Post by clhodapp »

iudqnolq wrote: post #20
hamandcheese wrote: post #13

Earlier quoted context omitted.

> No 2fa device has sufficient support that it could be used to unlock the lockscreen of any of my devices either. Remember, 2fa is your second factor. It’s right there in the acronym. It is there to protect against a bad actor stealing your password. By definition, a second factor won’t improve the ergonomics of logging in.

Not quite. A second factor would allow me to reduce the complexity of my password while retaining the same level of security. Without that the only benefit of a Yubikey over a strong password saved in a password manager is phishing protection, which I'm not willing to pay that amount of money for.

If you believe yourself essentially immune to phishing and password leakage, I don't think that you are very likely to be convinced that you should buy a Yubikey.

The place where they shine is when you have already acknowledged that you want (or have been forced by your employer to use) 2FA.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#79

Post by weichweich »

InvaderFizz wrote: post #76
turdnagel wrote: post #70

Earlier quoted context omitted.

Can you use the Yubikey as a keyboard on iOS?

Not sure if this answers your question, but you can use a Yubikey for FIDO2 on iOS with any iOS device with a USB port, or use the camera connection kit to make one on a Lightning port device. Source: I was curious, so I used a camera connection kit to login to Okta with a Yubikey as my MFA last month.

You can also use it with NFC.

Re: Show HN: A virtual Yubikey device for 2FA/WebAuthN

#80

Post by taubek »

nick__m wrote: post #54
iudqnolq wrote: post #2

I can't figure out why I'd want a Yubikey. Every year or so I try to figure out if a 2fa device practically has sufficient support that using it would improve my security. The answer has always been no. No 2fa device has sufficient support that it could increase the security of my 1password account, which I use on Linux and Android. No 2fa device has sufficient support that it could be used to unlock the lockscreen o…

I use 1Password and 2 Yubikey. Both yubikeys are configured to enter the same impossible to memorize password on a press to unlock 1Password, hid mode is supported by every device with a USB ports. I also use them as an otp second factor when a site requires it. Finally, they are configured with a x509 certificate that I use as my ssh keys. I generate one key per devices that way the secret never leaves it and I requ…

How do you configure Yubikey to enter password for unlocking 1password? Is this a Yubikey feature or 1password feature? Does this also work with mobile devices (phones)?
Post reply on HN