Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardware Touch, Stronger SSH

ubicloud.com

Post reply on HN
Print view View original

11–20 of 53 posts

Re: Hardware Touch, Stronger SSH

#11

Post by solatic »

This is how you handle it as an individual developer, but in a corporate environment things get real difficult, real fast. You need to set up your VMs and Git host to only trust certificates signed by an SSH certificate authority, and you need to work with users to submit the public key from the hardware-backed key to IT (controlling the CA) to get the public key signed and a certificate issued. Establishing trust when dealing with remote workers is hard unless you have both the budget and leadership patience to pay for overnight shipping, and even then, most people don't have access to tamper-proof packaging. Furthermore, for SSH CA support, GitHub requires Enterprise Cloud, GitLab requires Premium and self-hosted instances are not supported.

Would love to hear more from people getting this successfully set up at scale in corporate environments. I've seen big companies with lots of InfoSec talent not even attempt this.

Re: Hardware Touch, Stronger SSH

#12

Post by talkingtab »

In my opinion only, Yubico has done no favors to the Fido by their marketing. A result of trying to make Yubikey synonymous with Fido, it has become unclear what Fido does.

And as a result of how they market their keys, decisions Fido keys are presented with a cost of $20 - $60. Why $60, for a simple Fido key? Because for $60 you get not only Fido, but Flippo, Froggo, x.6s8o and more-o.

The result is that most people know the name Yubikey, but don't really know Fido, or what it is. On Amazon if you search for Fido you get mostly Yubikeys. There were other brands, but Yubico appears to have snuffed them. At one point there was an open source version that worked just as well as a name brand.

As for value? If you are a big corporate type this is the cat's meow. But otherwise? What other hardware is $60? A Raspberry Pi 4? I can get little cheap USB thingies from China at 6 for a dollar.

I am not pointing at Yubico as they have done well making profits from corporations. Rather the Fido Alliance. Looking at the Fido Alliance provides a first pass at answering the question "Who Benefits?"

https://fidoalliance.org/overview/leadership/

Perhaps it is fair to ask "What benefit" as well.

Corpocracy. You gotta love it.

Re: Hardware Touch, Stronger SSH

#14

Post by machinationu »

talkingtab wrote: post #12

In my opinion only, Yubico has done no favors to the Fido by their marketing. A result of trying to make Yubikey synonymous with Fido, it has become unclear what Fido does. And as a result of how they market their keys, decisions Fido keys are presented with a cost of $20 - $60. Why $60, for a simple Fido key? Because for $60 you get not only Fido, but Flippo, Froggo, x.6s8o and more-o. The result is that most people…

while you are right, security is generally not cheap.

you can get that $5 china fido key, but are you sure it's you who owns it?

I was recently looking for a security key, and eventually I did pay the yubico tax, because saving $20 by getting another one seemed unwise given the stakes.

Re: Hardware Touch, Stronger SSH

#16

Post by master_crab »

talkingtab wrote: post #12

In my opinion only, Yubico has done no favors to the Fido by their marketing. A result of trying to make Yubikey synonymous with Fido, it has become unclear what Fido does. And as a result of how they market their keys, decisions Fido keys are presented with a cost of $20 - $60. Why $60, for a simple Fido key? Because for $60 you get not only Fido, but Flippo, Froggo, x.6s8o and more-o. The result is that most people…

Most Government organizations mandate FIPS Yubikey’s that are outrageously priced.

Yes, the $60 is clear regulatory capture. It also sets back security by raising the barrier to using these devices.

Re: Hardware Touch, Stronger SSH

#17

Post by guerby »

I bought several "Security Key NFC by Yubico": their cheapest model, no storage or fancy stuff.

My personal strategy is to use keys generated this way:

ssh-keygen -t ed25519-sk

Rules:

- A generated key never leave the machine it was generated on.

- ssh agent is never used

- ProxyJump in HOME/.ssh/config or -J to have convenient access to all my servers.

- DynamicForward and firefox with foxyproxy extension to access various things in the remote network from my local machine (IPMI, internal services, IoT, ...)

- On the web no passkey, only simple 2FA webauthn.

My understanding is that more features including "storage" means more attack surface so by avoiding it you're 1/ more secure 2/ it's cheaper.

White paper on passkey says their security is equal to the security of the OS (Microsoft Windows ...) so I avoid passkeys.

Re: Hardware Touch, Stronger SSH

#18

Post by PunchyHamster »

guerby wrote: post #17

I bought several "Security Key NFC by Yubico": their cheapest model, no storage or fancy stuff. My personal strategy is to use keys generated this way: ssh-keygen -t ed25519-sk Rules: - A generated key never leave the machine it was generated on. - ssh agent is never used - ProxyJump in HOME/.ssh/config or -J to have convenient access to all my servers. - DynamicForward and firefox with foxyproxy extension to access…

The more expensive one works as smart card so you can both generate and keep the key as hardware only. Works for SSH and GPG too

Re: Hardware Touch, Stronger SSH

#19

Post by PunchyHamster »

talkingtab wrote: post #12

In my opinion only, Yubico has done no favors to the Fido by their marketing. A result of trying to make Yubikey synonymous with Fido, it has become unclear what Fido does. And as a result of how they market their keys, decisions Fido keys are presented with a cost of $20 - $60. Why $60, for a simple Fido key? Because for $60 you get not only Fido, but Flippo, Froggo, x.6s8o and more-o. The result is that most people…

You're paying for brand and the fact they make key exfiltration very hard.

Getting the key out of rpi4 will be trivally easy if someone stoles it, not so much for hardware key.

I am surprised that competition didn't kept them in check, we're using them for more than a decade and the price just keeps slowly creeping in.

Post reply on HN