Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
engineerbetter.com
Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
1–10 of 50 posts
Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
#2Has anyone actually seen personal SSH or Git signing keys get stolen and used in attacks (not counting servers sitting on the internet with ssh open) ? It seems like the only really useful purpose for these tokens is as an MFA token, because passwords just suck. At the same time, it seems like long random bits that can't be remembered by humans just aren't so vulnerable that we need to carry around something to unlock them.
Maybe the issue is just that it's so easy to attack password-protected systems that nobody even needs to attack keys.
Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
#3Does anyone use a Yubikey for personal rather than business/employment situations? Would a Yubikey ring make any sense for personal use (for example, you have Yubikey ring that connects via NFC with your device (phone, computer) and is require for auth'ing financial transactions?
Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
#4Storing your 1Password Master Password on a yubikey seems like a really bad idea for most threat models. This means that anybody in physical possession of the Yubikey can immediately and permanently steal your master password. Additionally, for shared computers, anyone who can run code on that system can log static creds, the same as if the user typed it.
Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
#5Does anyone use a Yubikey for personal rather than business/employment situations? Would a Yubikey ring make any sense for personal use (for example, you have Yubikey ring that connects via NFC with your device (phone, computer) and is require for auth'ing financial transactions?
That is sort of the idea. It's a relatively cheap authenticator that can be bought to provide 2FA for added security for your services. You can integrate it with Gmail, Mac Logins, etc.
Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
#6Shameless plug for a library that I wrote (still developing) for storing AWS API keys on a Yubikey (and signing API requests from the Yubikey): https://github.com/pyauth/exile
Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
#7Storing your 1Password Master Password on a yubikey seems like a really bad idea for most threat models. This means that anybody in physical possession of the Yubikey can immediately and permanently steal your master password. Additionally, for shared computers, anyone who can run code on that system can log static creds, the same as if the user typed it.
Agreed! I don't use that feature at all for the same reason. I don't have my key with me at all times.
Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
#8Has anyone actually seen personal SSH or Git signing keys get stolen and used in attacks (not counting servers sitting on the internet with ssh open) ? It seems like the only really useful purpose for these tokens is as an MFA token, because passwords just suck. At the same time, it seems like long random bits that can't be remembered by humans just aren't so vulnerable that we need to carry around something to unloc…
I personally don't see the point in them at all, in implementation and reality you get basically zero use out of the things.
Services that support them either have them locked down so hard that if you lose a single Yubikey (there's often no backup second key option), you're very screwed. Others go the other option, and have too easy to reset systems, SMS fallbacks, or other total bypasses of the security tokens.
For SSH and GPG, authentication keys are generally the least of your concern. The content you're controlling are much more valuable than the authentication itself. Can an attacker just wait until you SSH somewhere, and leverage that access? Can they wait until you'd press the button for another benign purpose and use that authentication in a malicious way? The answer is almost always yes, which reduces the value of these sort of devices substantially. They don't protect against local compromise, in which case a keyfile sitting on your local host is just as secure and a lot more convenient.
Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
#9I've got two Yubikeys already (a Neo, and an older barebones Yubikey that I got as a gift for getting an Ars Technica subscription), but so far Gmail is the only account of mine that is protected by it.
One repeated problem I've run into so far is that Firefox can read the Yubikey when it's inserted but it can't add the Yubikey as a new device yet. I have to pull up Chrome/Chromium to do so. After my most recent laptop reformat I vowed never to install Chromium again, even temporarily, so, out of luck until Mozilla gets that fixed, I suppose.
Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)
#10(Title needs the year since the article is from 2017.)
For keeping SSH keys, the PIV module seems a bit simpler than GPG. I just went through the process myself.[1]
They should also mention FIDO U2F, which already works well with Google, AWS and Github among others. Implementing it for your own site also seems doable.
1: https://blog.snapdragon.cc/2019/04/27/using-a-yubikey-to-sec...