Alternate title: guide to changing your single factor authentication from "something you know" to "something you have."
I think you mean from "something you can forget" to "something you can lose"
Passwordless Logins with Yubikey
11–20 of 66 posts
Re: Passwordless Logins with Yubikey
#12I feel like these devices generally give the illusion of security while really giving an adversary a single device to target. As another user had suggested, using udev rules and some device encryption would likely be a much better option... if not as an alternative, at least in conjunction with something like this.
> giving an adversary a single device to target
Technically, yes, but how do you target it? This is impossible to extract the private key from it.
Re: Passwordless Logins with Yubikey
#13I feel like these devices generally give the illusion of security while really giving an adversary a single device to target. As another user had suggested, using udev rules and some device encryption would likely be a much better option... if not as an alternative, at least in conjunction with something like this.
> giving an adversary a single device to target Technically, yes, but how do you target it? This is impossible to extract the private key from it.
By stealing the device.
Re: Passwordless Logins with Yubikey
#14I just bought two yubikeys; a month later, I returned both. Here is a (major) problem. On a ubuntu box, I installed `libpam-u2f` and set it up for one user account. Turns out it breaks all other user accounts on this ubuntu box, meaning no other user could log in without the key. I contacted their support. No solution.
I guess you can write your own pam module and use maybe an argument (your username) as a parameter. Just talking hypothetically: I think it should be possible
Re: Passwordless Logins with Yubikey
#15Re: Passwordless Logins with Yubikey
#16I just bought two yubikeys; a month later, I returned both. Here is a (major) problem. On a ubuntu box, I installed `libpam-u2f` and set it up for one user account. Turns out it breaks all other user accounts on this ubuntu box, meaning no other user could log in without the key. I contacted their support. No solution.
I don’t have a clue, but just from your description, it sounds like a bug in Ubuntu?
Re: Passwordless Logins with Yubikey
#17I just bought two yubikeys; a month later, I returned both. Here is a (major) problem. On a ubuntu box, I installed `libpam-u2f` and set it up for one user account. Turns out it breaks all other user accounts on this ubuntu box, meaning no other user could log in without the key. I contacted their support. No solution.
PAM is pretty flexible. Can't you just edit the configuration to only include the pam_u2f.so module for a certain user, or for users in a certain group? Or add the nouserok option[1] to allow authentication to proceed in the absence of registered U2F device?
The former approach would look something like this; the "default=1" part skips the next directive (pam_u2f.so) when the test fails (i.e. when the user is not in the mandatory_u2f group):
auth [success=ignore default=1] pam_succeed_if.so user ingroup mandatory_u2f
auth required pam_u2f.so cue
Re: Passwordless Logins with Yubikey
#18Earlier quoted context omitted.
> giving an adversary a single device to target Technically, yes, but how do you target it? This is impossible to extract the private key from it.
By stealing the device.
It's most likely easier to brute force a password than to break into someone's house. Would be easier to demand all credentials by gunpoint with that much effort.
Re: Passwordless Logins with Yubikey
#19True security is using both "something you know" and "something you have". Something you have can be stolen, and something you know can be tricked out of you. But stealing both is difficult and far more obvious.
To login to my work VPN, the password is "". Our SSO system requires both once per day as well.
It's a great system and I highly recommend it.
Re: Passwordless Logins with Yubikey
#20Cool. Now where's the guide to embed NFC enabled yubikeys in your hand?
According to some, you can get one with your covid vaccine :)