Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Store an SSH Key on a Yubikey

xeiaso.net

Post reply on HN
Print view View original

131–140 of 154 posts

Re: How to Store an SSH Key on a Yubikey

#131

Post by ratg13 »

BoppreH wrote: post #22
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

That's a very good question and in my opinion the biggest flaw with almost all new 2FA/passwordless systems. The "best practice" is to get a second yubikey or store recovery codes on paper, but that requires keeping them close to you because you'll need to update your backup on every new signup. That makes these systems entirely useless at protecting against house fires, signups while away from home, or simply servic…

>I think what we need is one master key that can be backed up in a offsite location (e.g. safe deposit box, lawyer, parents, trusted friends), and then have all subsequent secrets generated from it, or encrypted with it and stored somewhere publicly accessible.

This is a very good point. Essentially what you are describing here is a certificate authority.

The Yubikey, in this scenario, just acting as an 'offline CA'

It's a very good idea, but requires software being built to accept an authentication hierarchy.

Re: How to Store an SSH Key on a Yubikey

#132

Post by mschuster91 »

staticassertion wrote: post #126
mschuster91 wrote: post #75

Earlier quoted context omitted.

> Just using one key as your primary authentication adds a lot of security Yeah, and look just how often people lose or wash their phones or their keys, or how easy it is to break off a Yubikey that is on a keychain (e.g. when a cat pulls on it). Then you are usually royally screwed.

OK, how often? Seems like a relatively infrequent issue, although at the scale of cell phones it certainly happens "often". But you aren't really screwed, you can recover your accounts. You still know your password, you likely have an associated email, you may have even written down your recovery codes.

You can't login without the second factor and only the password because that is literally the entire point of having a second factor.

You should not be able to reset a 2FA token purely by having access to the target's email (or SMS) account in a halfway decent system.

Your only hope will be the recovery codes but well, how many people actually read the fine print on these?

Re: How to Store an SSH Key on a Yubikey

#133

Post by packetslave »

philderbeast wrote: post #102
mschuster91 wrote: post #87

Earlier quoted context omitted.

> If you lose your primary method you have to remember the password to unlock your secondary software ssh key.. The post I was replying to was talking about 2FA in general, not just for SSH keys. Many people take the advertisements of Facebook, Google, Twitter et al. to push for 2FA as pure gospel, but completely neglect "worst case recovery" scenarios - and then run into stone walls when it inevitably happens, becau…

AWS not offering multiple 2FA keys is one of my biggest annoyances, its a service that I feel much have 2FA due to its ability to run up extreme bills, but I also cant setup a backup key in case of loss or failure.

At $JOB-1 we solved this by building a virtual TOTP service that grabbed the MFA secret for a particular AWS account from our internal secrets tool (which itself required MFA and supported multiple users) and used it to generate codes.

Re: How to Store an SSH Key on a Yubikey

#134

Post by BoppreH »

ratg13 wrote: post #131
BoppreH wrote: post #22

Earlier quoted context omitted.

That's a very good question and in my opinion the biggest flaw with almost all new 2FA/passwordless systems. The "best practice" is to get a second yubikey or store recovery codes on paper, but that requires keeping them close to you because you'll need to update your backup on every new signup. That makes these systems entirely useless at protecting against house fires, signups while away from home, or simply servic…

> I think what we need is one master key that can be backed up in a offsite location (e.g. safe deposit box, lawyer, parents, trusted friends), and then have all subsequent secrets generated from it, or encrypted with it and stored somewhere publicly accessible. This is a very good point. Essentially what you are describing here is a certificate authority. The Yubikey, in this scenario, just acting as an 'offline CA'…

A lot simpler than a certificate authority, actually. There's no need for hierarchy, x509, or anything of the sort.

Take SQRL[1] for example. It's a login system where you scan a QR code with your phone, then your phone derives a private key based on the domain and a master key, and use that to sign a challenge. Every other device (including offline backups) will generate the same private key, and hence give access to the same account.

[1] https://www.grc.com/sqrl/sqrl.htm

Re: How to Store an SSH Key on a Yubikey

#135

Post by tooltower »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

Am I living too dangerously? I keep two U2F keys enrolled, one as a backup in a safe place, the other on my keyring. And for sites that still use passwords, in-browser password manager works well for me.

What kind of key-breaking do you think can still screw me over?

Re: How to Store an SSH Key on a Yubikey

#136

Post by nijave »

mschuster91 wrote: post #75
yakak wrote: post #36

Earlier quoted context omitted.

I think people start with trying to do the best practice too early. Just using one key as your primary authentication adds a lot of security as other authentication methods aren't as routinely exposed. That's enough to get started and makes it easier to think about backups when one is ready for multiple keys.

> Just using one key as your primary authentication adds a lot of security Yeah, and look just how often people lose or wash their phones or their keys, or how easy it is to break off a Yubikey that is on a keychain (e.g. when a cat pulls on it). Then you are usually royally screwed.

>or their keys

How often do people actually permanently lose their keys (besides just misplacing them or leaving them somewhere and getting them back)?

I'd saying losing keys (house key, car keys) is fairly rare.

Re: How to Store an SSH Key on a Yubikey

#137

Post by nijave »

philderbeast wrote: post #102
mschuster91 wrote: post #87

Earlier quoted context omitted.

> If you lose your primary method you have to remember the password to unlock your secondary software ssh key.. The post I was replying to was talking about 2FA in general, not just for SSH keys. Many people take the advertisements of Facebook, Google, Twitter et al. to push for 2FA as pure gospel, but completely neglect "worst case recovery" scenarios - and then run into stone walls when it inevitably happens, becau…

AWS not offering multiple 2FA keys is one of my biggest annoyances, its a service that I feel much have 2FA due to its ability to run up extreme bills, but I also cant setup a backup key in case of loss or failure.

It is a big annoyance but I think most places (once they're beyond a few engineers in size) use federated auth that support multiple keys (Okta, Active Directory, GSuite) for AWS access.

You can also use TOTP and store the secret in a password manager then protect that with hardware keys.

Re: How to Store an SSH Key on a Yubikey

#138

Post by notatoad »

kapep wrote: post #54
gruturo wrote: post #34

Earlier quoted context omitted.

You're not wrong, but this is exactly the use case for a USB security stick. The key is in there, cannot be extracted in any way*, can only be "used" (not accessed or copied, just used for crypto operations) while the stick is plugged in, and without it it's impossible to proceed. It kind of goes without saying that losing the key results in you getting locked out - if there was any other way there wouldn't really be…

> It kind of goes without saying that losing the key results in you getting locked out - if there was any other way there wouldn't really be much of a point to the complication of making yourself dependent on a stick. > As a backup, you either have some kind of spare keys in safe storage or reliable access to someone who can restore your access after having identified you. I have two Yubikeys, but I don't consider th…

>I have two Yubikeys, but I don't consider the second one as "spare" that has to be locked away. I carry one USB-C/NFC key on my key chain. The other is a USB-A Yubikey nano, which is always at home in my desktop's monitor USB port so I can reach it very easily. By using both regularly, I'm more likely notice if one key gets broken or lost.

yeah, this is the way to do it. worrying about losing keys is a valid concern for webauthn where some poorly-configured services might only let you enrol a single key, but we've (mostly) got ssh figured out by now and everything lets you use multiple keys. so register and use multiple keys on a regular basis.

Re: How to Store an SSH Key on a Yubikey

#140

Post by marcosdumay »

nijave wrote: post #136
mschuster91 wrote: post #75

Earlier quoted context omitted.

> Just using one key as your primary authentication adds a lot of security Yeah, and look just how often people lose or wash their phones or their keys, or how easy it is to break off a Yubikey that is on a keychain (e.g. when a cat pulls on it). Then you are usually royally screwed.

>or their keys How often do people actually permanently lose their keys (besides just misplacing them or leaving them somewhere and getting them back)? I'd saying losing keys (house key, car keys) is fairly rare.

How often have you had a flash drive that stopped working for some reason?

Physically losing the keys isn't the only way to lose them.

Post reply on HN