Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Yubikey

debugging.works

Post reply on HN
Print view View original

101–110 of 186 posts

Re: How to Yubikey

#101

Post by thesuitonym »

ixwt wrote: post #86
nextlevelwizard wrote: post #12

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

If you setup a domain to use Cloudflare, and then sign up for their zero trust system, you can get a code to get up to 4 yuibkey's for $10 each.

Are these the good Yubikeys or the basic FIDO-only models?

Re: How to Yubikey

#102

Post by sowbug »

TacticalCoder wrote: post #57
sheerun wrote: post #21

I really would like to use it, but without ability to backup it, I don't wanna. I've read some time ago Yubikey of some other company showed initial spec, but I never heard any followup, I don't remember the link. For now I'm using TOTP but it's a chore. Salesforce Authenticator has nice idea with custom push-based protocol, but it's not running on dedicated hardware. I think ESP32 S3 has hardware potential to act as…

> I really would like to use it, but without ability to backup it I totally know the feeling. I was there, I don't believe for a second that enrolling another key is an acceptable option and I solved that problem in a way that works for me. You can clone your own security key if you're willing to deal with the problem that now becomes: "How do I safely store the secret allowing to restore another security key?" . I'm…

Have you tested this solution? Unless something has changed since the initial spec, each handshake includes a usage counter, which the relying party sees and is supposed to remember. If the usage counter ever fails to increase, then that means something weird happened (like two keys acting as one), and the site can reject you.

There are crude ways to deal with this issue, which are fine if you intend for the second to be used only in case of emergency.

Re: How to Yubikey

#103

Post by denysvitali »

OJFord wrote: post #22
upofadown wrote: post #18

Earlier quoted context omitted.

According to this: * https://github.com/drduh/YubiKey-Guide#configure-smartcard ... it is: gpg --card-edit

Ah, thanks, it is described at the bottom of that section, but it's actually: ykman openpgp access set-retries 5 5 5 -f -a YOUR_ADMIN_PIN (5 5 5 being the number of retries for encrypt/sign/auth) Now, do I know my admin PIN...

By default it is 12345678 IIRC

Re: How to Yubikey

#104

Post by imiric »

stavros wrote: post #87

With the way things are going (U2F/WebAuthn), Yubikeys are being commoditized, and that's a good thing. I have 5-6 Yubikeys, but nowadays the one I use most is the Solo 2 I embedded in my laptop[0]. Pretty much the only thing I use a Yubikey for nowadays is U2F, and I might as well use any cheaper key for that, since they're all equivalent (Solo 2 even has much more space for resident keys). I don't think there's muc…

> With the way things are going (U2F/WebAuthn), Yubikeys are being commoditized, and that's a good thing.

I very much doubt this. Security keys are only used by a very niche community of security minded tech geeks. They're either unknown or very user unfriendly and a nuissance to the vast majority of tech users. Hell, I only use them because not using them is not an option, but I'm constantly annoyed with having to _think_ about them, rotate keys, manage passwords, etc.

While WebAuthn and passkeys are becoming more prevalent and standardized, and that's certainly a good thing, the future of increased security for everyone will not involve security keys. Most users will authenticate using their phone or biometric data, which will create passkeys for each purpose, stored securely in the background on a TPM-like device, and synced using traditional methods.

So security keys will remain a niche product, for those of us who don't trust these new authentication models, or have to keep managing passwords for likely many years to come.

Re: How to Yubikey

#105

Post by Arch-TK »

nextlevelwizard wrote: post #12

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

The cost is not really that enormous when you consider these things are pretty bulletproof, I've had one for about 10 years on my keychain. That's €5 per year. I am currently waiting for NitroKey 3 to have non-alpha OpenPGP SC support and will likely buy one as soon as it's available (although maybe I should buy one now to support development and maybe have a play around myself).

You don't need a backup unless you don't trust your hardware at home, just store backup keys on some trusted host, or offline on some storage media, you then only need to buy a new security key whenever you lose yours. Even so, if you DO decide to go the backup route, the backup is not likely to get list and very likely to last much longer than 10 years.

With security keys which have NFC capabilities, you can set things up so that accessing any website from your phone is only a tap away (you need to enter the pin before hand, or every time, obviously choice of convenience here is up to you but if your phone itself is secure enough then maybe this isn't such an issue to keep the pin cached while the phone is on).

Re: How to Yubikey

#106

Post by krupan »

sverhagen wrote: post #15
nextlevelwizard wrote: post #12

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

>a backup >convenience I always wonder how often someone gets into a crisis because their Yubikey breaks while they're at, say, a conference (ie. far away from the backup, be it another key, or access to recover codes). I recon they can just break when plugged into a laptop that takes a dive.

Yubikey hardware is surprisingly robust. Mine has been on my physical keychain for years, getting thrown around and banged up and it’s fine

Re: How to Yubikey

#107

Post by stavros »

imiric wrote: post #104
stavros wrote: post #87

With the way things are going (U2F/WebAuthn), Yubikeys are being commoditized, and that's a good thing. I have 5-6 Yubikeys, but nowadays the one I use most is the Solo 2 I embedded in my laptop[0]. Pretty much the only thing I use a Yubikey for nowadays is U2F, and I might as well use any cheaper key for that, since they're all equivalent (Solo 2 even has much more space for resident keys). I don't think there's muc…

> With the way things are going (U2F/WebAuthn), Yubikeys are being commoditized, and that's a good thing. I very much doubt this. Security keys are only used by a very niche community of security minded tech geeks. They're either unknown or very user unfriendly and a nuissance to the vast majority of tech users. Hell, I only use them because not using them is not an option, but I'm constantly annoyed with having to _…

I meant "it doesn't matter which key you get, they're all the same", not "everyone has one".

Re: How to Yubikey

#108

Post by imiric »

stavros wrote: post #107
imiric wrote: post #104

Earlier quoted context omitted.

> With the way things are going (U2F/WebAuthn), Yubikeys are being commoditized, and that's a good thing. I very much doubt this. Security keys are only used by a very niche community of security minded tech geeks. They're either unknown or very user unfriendly and a nuissance to the vast majority of tech users. Hell, I only use them because not using them is not an option, but I'm constantly annoyed with having to _…

I meant "it doesn't matter which key you get, they're all the same", not "everyone has one".

Ah, sorry for misunderstanding.

BTW, that's a pretty cool project embedding a Solo 2 into the laptop. Shame you're now stuck with the Framework, but it's awesome that kind of project is even possible. I still prefer using a regular smartcard, since some (many?) laptops have built-in readers. And I miss PCMCIA slots, which were a perfect fit for smartcard readers, until they took it away from us. :(

Re: How to Yubikey

#109

Post by stavros »

imiric wrote: post #108
stavros wrote: post #107

Earlier quoted context omitted.

I meant "it doesn't matter which key you get, they're all the same", not "everyone has one".

Ah, sorry for misunderstanding. BTW, that's a pretty cool project embedding a Solo 2 into the laptop. Shame you're now stuck with the Framework, but it's awesome that kind of project is even possible. I still prefer using a regular smartcard, since some (many?) laptops have built-in readers. And I miss PCMCIA slots, which were a perfect fit for smartcard readers, until they took it away from us. :(

Oh I'm not stuck, it's a removable port, I can just take the key out whenever. I think USB-C is more flexible than PCMCIA, especially with the Framework's module bays.

Re: How to Yubikey

#110

Post by aareet »

sedatk wrote: post #11
toastal wrote: post #5

Reminder: Yubico doesn't have a monopoly on security keys. Make sure your software/tutorials support the open-source alternatives like OnlyKey and NitroKey.

or SoloKey

I've found Solokey to be unreliable. Recently, for example, I learned that the Solokey 2 can't be added to iCloud as a security key
Post reply on HN