Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Yubikey

debugging.works

Post reply on HN
Print view View original

141–150 of 186 posts

Re: How to Yubikey

#141

Post by idiotsecant »

password4321 wrote: post #132
nyolfen wrote: post #98

Earlier quoted context omitted.

do any other keys have feature sets on par with yubikeys? last i checked they were ahead by a mile, the others i looked at were just fido2 keys

Not really keys, but hardware wallets like Trezor or Ledger can do a lot of this for ~twice the price.

Hardware wallet authentication is really one of the 'web3' technologies that just works and we could be deploying everywhere right now. It's miles better than yubikey spitting out a static password, has plugins for every major browser and mobile device platform, can do identity verification without specific site account setup, and of course the whole pile of (optional) web3 things with crypto.

Re: How to Yubikey

#142

Post by Borealid »

meepmorp wrote: post #113
evil-olive wrote: post #111

Earlier quoted context omitted.

so far, Yubikeys are the only ones I've found that support both FIDO2 / WebAuthn as well as GPG smart card functionality for use with pass(1). they also support ed25519 FIDO SSH keys, whereas all the cheapo FIDO keys I've tested only support ecdsa-nistp256, but that's a relatively minor difference. Nitrokey 3 claims that GPG smart card support is planned in an upcoming firmware update. once that's released I may bite…

Also, yubikey works as a PIV smartcard

If you get a smartcard, you can install https://github.com/BryanJacobs/FIDO2Applet on it to make it into a FIDO2 authenticator. You can install a GPG and a PIV applet too.

A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you likely do not want).

Re: How to Yubikey

#143

Post by mfsch »

I wish it was possible to add FIDO keys to an account without having physical access to the key. Without this, it is hard to balance the convenience of adding your keys to new accounts and the risk of losing all your keys. Ideally, I’d want to keep one key in a safe location far away and just have some public key data that I can upload to new accounts. Does anyone know why FIDO doesn’t work this way? Is it simply to make it harder to lock yourself out of an account?

Re: How to Yubikey

#144

Post by password4321 »

Borealid wrote: post #142
meepmorp wrote: post #113

Earlier quoted context omitted.

Also, yubikey works as a PIV smartcard

If you get a smartcard, you can install https://github.com/BryanJacobs/FIDO2Applet on it to make it into a FIDO2 authenticator. You can install a GPG and a PIV applet too. A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you likely do not want).

I think the keyboard aspect was wanted back when smart card readers and extra software drivers were needed, but there are USB "smart cards" now and operating system support is solid.

Re: How to Yubikey

#145

Post by password4321 »

idiotsecant wrote: post #141
password4321 wrote: post #132

Earlier quoted context omitted.

Not really keys, but hardware wallets like Trezor or Ledger can do a lot of this for ~twice the price.

Hardware wallet authentication is really one of the 'web3' technologies that just works and we could be deploying everywhere right now. It's miles better than yubikey spitting out a static password, has plugins for every major browser and mobile device platform, can do identity verification without specific site account setup, and of course the whole pile of (optional) web3 things with crypto.

To be clear, I pointed out that the wallets can do many of the things the Yubikey can do (in addition to what you mentioned).

Re: How to Yubikey

#146

Post by ngai_aku »

jrib wrote: post #96
ixwt wrote: post #86

Earlier quoted context omitted.

If you setup a domain to use Cloudflare, and then sign up for their zero trust system, you can get a code to get up to 4 yuibkey's for $10 each.

Is this still the case? I came across this blog post about a similar offer: https://blog.cloudflare.com/making-phishing-defense-seamless... but it now states: > UPDATE: This offer expired on January 3rd, 2023 at 8am PST.

Yeah, I don’t think it’s live anymore. I had the same feelings as gp re: up front price, so I went searching for deals and came across that cloudflare offer on Reddit. Several users have commented on the thread post-January 3rd stating that they tried and failed to unlock the deal

Re: How to Yubikey

#147

Post by meepmorp »

password4321 wrote: post #144
Borealid wrote: post #142

Earlier quoted context omitted.

If you get a smartcard, you can install https://github.com/BryanJacobs/FIDO2Applet on it to make it into a FIDO2 authenticator. You can install a GPG and a PIV applet too. A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you likely do not want).

I think the keyboard aspect was wanted back when smart card readers and extra software drivers were needed, but there are USB "smart cards" now and operating system support is solid.

The HID support also lets you set a static string to send when you touch the button. Their homemade OTP uses it, too.

Re: How to Yubikey

#148

Post by piperswe »

Borealid wrote: post #142
meepmorp wrote: post #113

Earlier quoted context omitted.

Also, yubikey works as a PIV smartcard

If you get a smartcard, you can install https://github.com/BryanJacobs/FIDO2Applet on it to make it into a FIDO2 authenticator. You can install a GPG and a PIV applet too. A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you likely do not want).

Where does one acquire a smartcard? I can't find anywhere without a MOQ

Re: How to Yubikey

#149

Post by piperswe »

thesuitonym wrote: post #101
ixwt wrote: post #86

Earlier quoted context omitted.

If you setup a domain to use Cloudflare, and then sign up for their zero trust system, you can get a code to get up to 4 yuibkey's for $10 each.

Are these the good Yubikeys or the basic FIDO-only models?

Back when this promo was still going on, they were the good ones

Re: How to Yubikey

#150

Post by sneakerblack »

aborsy wrote: post #136

Most security keys can’t act as GPG smart cards, other than Yubikeys. So I only buy Yubikeys. An encryption, authentication and sign keg in a Yubikey is very useful. Does anyone know if a Wireguard secret key could be transferred to Yubikey?

It seems like you can by using the PIV applet found in yubikeys:

https://www.procustodibus.com/blog/2023/02/wireguard-yubikey...

You can read more about the type of cryptography that wireguard uses here:

https://www.wireguard.com/protocol/

Post reply on HN