Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Yubikey

debugging.works

Post reply on HN
Print view View original

131–140 of 186 posts

Re: How to Yubikey

#131

Post by kccqzy »

jonas-w wrote: post #2

For full disk encryption, if you use systemd and not another init system, i'd also recommend systemd-cryptsetup, it's already installed on your machine if you have a relatively new systemd (at least 248). With systemd-cryptsetup you can use fido2, and your normal fido2 pin, to unlock your LUKS drive. This also works with the YubiKeys "Security Key" series, that only have fido2 and no otp/chalresp.

I actually considered that setup but decided against it. The thing is, if I did this, I would eventually succumb to convenience and would plug the key into the machine at all times. But that defeats the purpose: if a thief steals my computer they can just tap the key rather than know my password to unlock my disk.

Re: How to Yubikey

#132

Post by password4321 »

nyolfen wrote: post #98
toastal wrote: post #5

Reminder: Yubico doesn't have a monopoly on security keys. Make sure your software/tutorials support the open-source alternatives like OnlyKey and NitroKey.

do any other keys have feature sets on par with yubikeys? last i checked they were ahead by a mile, the others i looked at were just fido2 keys

Not really keys, but hardware wallets like Trezor or Ledger can do a lot of this for ~twice the price.

Re: How to Yubikey

#133

Post by ilyt »

hsbauauvhabzb wrote: post #127
toastal wrote: post #5

Reminder: Yubico doesn't have a monopoly on security keys. Make sure your software/tutorials support the open-source alternatives like OnlyKey and NitroKey.

I’m unclear as to why we can’t use some sort of tpm for webauthn and distributed encrypted passwords for synchronisation. Hell, even software based implementations which force domain checking would solve 99% of the problem…

Technically, we can just use client certs, YK supports them (via smartcard emulation, you can also use that to auth via SSH), just it wasn't really there, ever, on UI front...

Re: How to Yubikey

#134

Post by hot_gril »

nextlevelwizard wrote: post #12

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

Same, I only use the key when something forces me to, cause I trust TOTP authentication apps even less. (I don't mean trusting that nobody hacks it, I mean trusting that I don't get locked out.)

Re: How to Yubikey

#135

Post by hot_gril »

lxgr wrote: post #65
agotterer wrote: post #61

Earlier quoted context omitted.

I’ve carried a USB-A Yubikey in my pocket for 7 years and it’s never broke. I also keep one time login passwords encrypted and available in the cloud in the event I lose the key.

I've had one USB-C key break on me in the past, and my replacement is already showing signs of wear. Fortunately it's not my only way to get back into my accounts if it breaks. My (sample size 2) theory is that USB-C isn't the best connector for a security key, since it intentionally moves the wear-prone part (i.e. the dust-collecting and mechanical spring involving side) from the port to the cable. USB-A is complete…

Flat USB-A security keys are nice. But I've yet to subject mine to the bus test.

Re: How to Yubikey

#136

Post by aborsy »

Most security keys can’t act as GPG smart cards, other than Yubikeys. So I only buy Yubikeys.

An encryption, authentication and sign keg in a Yubikey is very useful.

Does anyone know if a Wireguard secret key could be transferred to Yubikey?

Re: How to Yubikey

#137

Post by mfontani »

> You can add 32 of these secrets to a Yubikey device.

I have 45 of those currently in my Authy account, which syncs on two phones for redundancy...

I'd love to use a Yubikey for this, but I'd have to split those accounts across multiple yubikeys, which would be quite a headache to maintain, especially if one wants redundancy...

Re: How to Yubikey

#138

Post by sargun »

vifon wrote: post #50

> I don’t see any use case or security benefits by using the static password feature. Even if you enter a password manually and concatenate it with the password of the Yubikey, a keylogger still gets both parts (assumption: You don’t reuse passwords). If keylogger is what you're defending from, yes, it doesn't help. And in this scenario you've probably already lost. On the other hand, it makes a large portion of the…

The static password feature would actually be perfect with a few small alterations.

I use Apple's Advanced Data Protection product. This product gives you a 64-character code you must know. I am probably not capable of committing this code to memory.

I wish I could tell my Yubikey this code, and it would save it.

---

Now, as a US citizen, it is very hard for the government to compel me to disclose a password or a pin code. If the static password feature required a simple password (say 6 characters), with reasonable brute force prevention, it'd make it so that I have a way to protect myself. On the other hand, if it is not pin protected, there is nothing preventing the government from getting a search warrant for the Yubikey itself and using that.

Re: How to Yubikey

#139

Post by palata »

evil-olive wrote: post #111
nyolfen wrote: post #98

Earlier quoted context omitted.

do any other keys have feature sets on par with yubikeys? last i checked they were ahead by a mile, the others i looked at were just fido2 keys

so far, Yubikeys are the only ones I've found that support both FIDO2 / WebAuthn as well as GPG smart card functionality for use with pass(1). they also support ed25519 FIDO SSH keys, whereas all the cheapo FIDO keys I've tested only support ecdsa-nistp256, but that's a relatively minor difference. Nitrokey 3 claims that GPG smart card support is planned in an upcoming firmware update. once that's released I may bite…

> Nitrokey 3 claims that GPG smart card support is planned in an upcoming firmware update. once that's released I may bite the bullet on shipping costs and order one. 55€ shipping to the US for a 49€ key is cost-prohibitive for the most part.

They have been claiming many things. I pre-ordered a Nitrokey 1.5 years ago, still haven't received it, and apparently during this time they have not implemented much.

https://www.nitrokey.com/blog/2023/nitrokey-3-status-update-...

Re: How to Yubikey

#140

Post by jonas-w »

kccqzy wrote: post #131
jonas-w wrote: post #2

For full disk encryption, if you use systemd and not another init system, i'd also recommend systemd-cryptsetup, it's already installed on your machine if you have a relatively new systemd (at least 248). With systemd-cryptsetup you can use fido2, and your normal fido2 pin, to unlock your LUKS drive. This also works with the YubiKeys "Security Key" series, that only have fido2 and no otp/chalresp.

I actually considered that setup but decided against it. The thing is, if I did this, I would eventually succumb to convenience and would plug the key into the machine at all times . But that defeats the purpose: if a thief steals my computer they can just tap the key rather than know my password to unlock my disk.

You normally have and you should have a fido2 pin, which is just a password. A thief would need your laptop, your security key, and the fido2 pin.

Here is an article (from yubico) about fido2 pins: https://support.yubico.com/hc/en-us/articles/4402836718866-U...

Post reply on HN