Getting Started with Security Keys
paulstamatiou.com
Getting Started with Security Keys
1–10 of 104 posts
Re: Getting Started with Security Keys
#2These hardware tokens usually support PGP as well! It's possible to generate a full set of keys on the device. Combining this with an offline primary key makes for a very secure system that's also relatively easy to use.
Re: Getting Started with Security Keys
#3These hardware tokens usually support PGP as well! It's possible to generate a full set of keys on the device. Combining this with an offline primary key makes for a very secure system that's also relatively easy to use.
Most FIDO devices don't do anything else. Yubico sells a lot of products that do, but Yubico's cheapest line of FIDO compliant USB keys, and most competitors cheaper products do not do anything except FIDO.
Re: Getting Started with Security Keys
#4[deleted]
Re: Getting Started with Security Keys
#5Unpopular opinion: These keys are about selling the idea that physical-based security is somehow magically better.
If you have good password hygene (read: a decent password manager) then I'll need to breach your host to obtain it - if you use a security key, I'll have to breach your host and hijack your session which is slightly more convenient but chances are you're royally screwed once you're breached anyway.
Sure there's some edge cases where this might work (one-way keyloggers, etc) but these aren't realistic threats for a large majority of people.
Somehow a sales team have taken a bullet hole, and attempted to use a square peg to band-aid it.
Stop buying stupid products and just use a damn password manager.
Re: Getting Started with Security Keys
#6SSH key storage needs more info I think. I am using SSH enough that this '...can also do SSH...' would want to be the main topic.
advanced modes disabling API keys means a lot of the older third party integrations which depend on a simple API token are SOL. this worries me, lockin risks.
Re: Getting Started with Security Keys
#7Unpopular opinion: These keys are about selling the idea that physical-based security is somehow magically better. If you have good password hygene (read: a decent password manager) then I'll need to breach your host to obtain it - if you use a security key, I'll have to breach your host and hijack your session which is slightly more convenient but chances are you're royally screwed once you're breached anyway. Sure…
[deleted]
Re: Getting Started with Security Keys
#8These hardware tokens usually support PGP as well! It's possible to generate a full set of keys on the device. Combining this with an offline primary key makes for a very secure system that's also relatively easy to use.
Most FIDO devices don't do anything else. Yubico sells a lot of products that do, but Yubico's cheapest line of FIDO compliant USB keys, and most competitors cheaper products do not do anything except FIDO.
Yeah and you really want FIDO. It's such a better experience.
Re: Getting Started with Security Keys
#9SSH key storage needs more info I think. I am using SSH enough that this '...can also do SSH...' would want to be the main topic. advanced modes disabling API keys means a lot of the older third party integrations which depend on a simple API token are SOL. this worries me, lockin risks.
>SSH key storage needs more info I think. I am using SSH enough that this '...can also do SSH...' would want to be the main topic.
Different audiences, I think - this article doesn't go into technical details that often besides mentioning various protocols and what they do. Using a Yubikey for SSH (either via GPG or X.509 certs) is significantly more involved than using one for U2F/FIDO2.
There's a pretty in-depth guide here on using one as a GPG smartcard with SSH (that's what I do): https://zeos.ca/post/2018/gpg-yubikey5/
Re: Getting Started with Security Keys
#10Unpopular opinion: These keys are about selling the idea that physical-based security is somehow magically better. If you have good password hygene (read: a decent password manager) then I'll need to breach your host to obtain it - if you use a security key, I'll have to breach your host and hijack your session which is slightly more convenient but chances are you're royally screwed once you're breached anyway. Sure…
> Unpopular opinion
Yes, quite unpopular since keyloggers and clipboard watching malware are probably a threat model to many more people than someone stealing a security key off your keychain.