11–20 of 50 posts
I like the idea of SSH'ing with it, ill give that a shot.
(Title needs the year since the article is from 2017.) For keeping SSH keys, the PIV module seems a bit simpler than GPG. I just went through the process myself.[1] They should also mention FIDO U2F, which already works well with Google, AWS and Github among others. Implementing it for your own site also seems doable. 1: https://blog.snapdragon.cc/2019/04/27/using-a-yubikey-to-sec...
I've thought about adding support for remembering devices but using the token is so easy it's just not a priority.
Storing your 1Password Master Password on a yubikey seems like a really bad idea for most threat models. This means that anybody in physical possession of the Yubikey can immediately and permanently steal your master password. Additionally, for shared computers, anyone who can run code on that system can log static creds, the same as if the user typed it.
I like the added security of yubikeys, I use it for Google account and Facebook. Sadly it won't easily work everywhere, I seem to always have issues with my smartphone (missing adapter or rfid not working well), but my biggest pain is it doesn't work on PS4, my youtube account always gets unlinked randomly, than I need to go my computer, disable 2FA, sign-in on the ps4, and reenable 2FA. I like the idea of SSH'ing wi…
Does anyone use a Yubikey for personal rather than business/employment situations? Would a Yubikey ring make any sense for personal use (for example, you have Yubikey ring that connects via NFC with your device (phone, computer) and is require for auth'ing financial transactions?
That is sort of the idea. It's a relatively cheap authenticator that can be bought to provide 2FA for added security for your services. You can integrate it with Gmail, Mac Logins, etc.
(Title needs the year since the article is from 2017.) For keeping SSH keys, the PIV module seems a bit simpler than GPG. I just went through the process myself.[1] They should also mention FIDO U2F, which already works well with Google, AWS and Github among others. Implementing it for your own site also seems doable. 1: https://blog.snapdragon.cc/2019/04/27/using-a-yubikey-to-sec...
On the flip side, with PIV there’s no way I’ve seen to have it allow access for a short period of time (eg the way gpg can cache the pin for a set number of seconds) instead of per request which can get a bit annoying if you are invoking ssh repeatedly (which I seem to do a fair bit).
Would also reference the excellent yubioath tool for adding TOTP passwords on sites which don’t support FIDO/U2F - it’s very very easy to use and if you have an Android phone and an NFC enabled yubikey you can use there too.
Has anyone actually seen personal SSH or Git signing keys get stolen and used in attacks (not counting servers sitting on the internet with ssh open) ? It seems like the only really useful purpose for these tokens is as an MFA token, because passwords just suck. At the same time, it seems like long random bits that can't be remembered by humans just aren't so vulnerable that we need to carry around something to unloc…
I personally don't see the point in them at all, in implementation and reality you get basically zero use out of the things. Services that support them either have them locked down so hard that if you lose a single Yubikey (there's often no backup second key option), you're very screwed. Others go the other option, and have too easy to reset systems, SMS fallbacks, or other total bypasses of the security tokens. For…
Storing your 1Password Master Password on a yubikey seems like a really bad idea for most threat models. This means that anybody in physical possession of the Yubikey can immediately and permanently steal your master password. Additionally, for shared computers, anyone who can run code on that system can log static creds, the same as if the user typed it.
I like the added security of yubikeys, I use it for Google account and Facebook. Sadly it won't easily work everywhere, I seem to always have issues with my smartphone (missing adapter or rfid not working well), but my biggest pain is it doesn't work on PS4, my youtube account always gets unlinked randomly, than I need to go my computer, disable 2FA, sign-in on the ps4, and reenable 2FA. I like the idea of SSH'ing wi…
Yubikey 5 supports NFC for mobile, might work for your use case (smartphone challenges).
Also on Android (but again not on iOS), Chrome (but sadly not Firefox as far as I know yet) can use the google authenticator app (again sadly I think no alternatives to this yet) to speak FIDO with an NFC yubikey.
I like the added security of yubikeys, I use it for Google account and Facebook. Sadly it won't easily work everywhere, I seem to always have issues with my smartphone (missing adapter or rfid not working well), but my biggest pain is it doesn't work on PS4, my youtube account always gets unlinked randomly, than I need to go my computer, disable 2FA, sign-in on the ps4, and reenable 2FA. I like the idea of SSH'ing wi…