Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Yubikey

debugging.works

Post reply on HN
Print view View original

151–160 of 186 posts

Re: How to Yubikey

#151

Post by aborsy »

sneakerblack wrote: post #150
aborsy wrote: post #136

Most security keys can’t act as GPG smart cards, other than Yubikeys. So I only buy Yubikeys. An encryption, authentication and sign keg in a Yubikey is very useful. Does anyone know if a Wireguard secret key could be transferred to Yubikey?

It seems like you can by using the PIV applet found in yubikeys: https://www.procustodibus.com/blog/2023/02/wireguard-yubikey... You can read more about the type of cryptography that wireguard uses here: https://www.wireguard.com/protocol/

Thanks, the post is good!

But I have to admit that there is probably no way to do that properly. If Wireguard key is in Yubikey, every packet has to go to Yubikey for encryption and decryption. That doesn’t work!

The usual recommendation is to encrypt the Wireguard key with pass or gpg. But an attacker that can access a Wireguard key in /etc/Wireguard must have root access. Such attacker would have access to stdout put by Gpg and could read the key. It could also dump the memory and read the key from there.

Re: How to Yubikey

#152

Post by toastal »

nyolfen wrote: post #129
jrm4 wrote: post #122

Earlier quoted context omitted.

If they don't, that's more of a reason to use the OTHERS? You really don't want a monoculture here.

i would be happy to use the OTHERS if they were comparable products

What if open source is your most-wanted feature? That hardware isn't open.

Re: How to Yubikey

#154

Post by nextlevelwizard »

eropple wrote: post #84
nextlevelwizard wrote: post #25

Earlier quoted context omitted.

In normal life losing access to your phone won't lock you out of everything. You still have all your other devices you can use AND you can always just walk into store and buy yourself a replacement and download your phone back from a backup. Same with laptops. If you go to a conference and your laptop breaks. You can just go to nearest store and buy a new one. It will take couple hours, but you'll be up and running a…

I can still get into "life stuff" without my Yubikey. There are increases in risk to doing so (TOTP requests have decreased resistance to phishing attacks versus webauthn, for example), which is why I don't do that generally, but the fallbacks are not a serious problem. I would have to lose/break my phone and my laptop (both secured via Apple's stuff, not my Yubikey) and my Yubikey to be materially locked out of thin…

If you only use the key to SSH then fine, but then I am not willing to pay more than 10€ for set of two.

Re: How to Yubikey

#155

Post by nextlevelwizard »

vifon wrote: post #52
nextlevelwizard wrote: post #12

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

> Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience. In terms of the SSH and GPG keys which I use multiple times every single day for me this is convenience. I have my keys always on my person and they are tied to me, and not a particular machine. Whether it's my laptop, my desktop or my phone, I have a single pair of keys that are virtually impossible to steal even o…

I am just not at all paranoid about my SSH keys. Those are password protected and the worst that you can do with them is to run some low yield miner on my machines. I guess you could "steal" my source code, but I publish it free on github anyway.

Maybe convenient if you are administrator or something, but for normal life seems unnecessary.

However I can see the appeal of having everything behind a physical factor

Re: How to Yubikey

#156

Post by privacyking »

piperswe wrote: post #148
Borealid wrote: post #142

Earlier quoted context omitted.

If you get a smartcard, you can install https://github.com/BryanJacobs/FIDO2Applet on it to make it into a FIDO2 authenticator. You can install a GPG and a PIV applet too. A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you likely do not want).

Where does one acquire a smartcard? I can't find anywhere without a MOQ

https://www.floss-shop.de/en/security-privacy/smartcards/

Re: How to Yubikey

#157

Post by Borealid »

privacyking wrote: post #156
piperswe wrote: post #148

Earlier quoted context omitted.

Where does one acquire a smartcard? I can't find anywhere without a MOQ

https://www.floss-shop.de/en/security-privacy/smartcards/

If you want to run flexible apps, I think you'd probably want a Javacard like those sold by https://www.smartcardfocus.com/shop/ilp/se~71/java-cards/p/i... , not a special "PGP Card".

Re: How to Yubikey

#158

Post by Melatonic »

hot_gril wrote: post #134
nextlevelwizard wrote: post #12

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

Same, I only use the key when something forces me to, cause I trust TOTP authentication apps even less. (I don't mean trusting that nobody hacks it, I mean trusting that I don't get locked out.)

Thankfully now with Google Authenticator at least you can export the config to another device. I periodically do this to my old Android phone so I have a backup device in case I destroy my current one

Re: How to Yubikey

#159

Post by Melatonic »

idiotsecant wrote: post #141
password4321 wrote: post #132

Earlier quoted context omitted.

Not really keys, but hardware wallets like Trezor or Ledger can do a lot of this for ~twice the price.

Hardware wallet authentication is really one of the 'web3' technologies that just works and we could be deploying everywhere right now. It's miles better than yubikey spitting out a static password, has plugins for every major browser and mobile device platform, can do identity verification without specific site account setup, and of course the whole pile of (optional) web3 things with crypto.

Any that are recommended for longevity? What can a Yubikey do that these wallets cannot?

Re: How to Yubikey

#160

Post by clircle »

InCityDreams wrote: post #91
djha-skin wrote: post #79

It's pretty annoying having to touch my yubi key every single time. I find KeePassXC + TOTP much more user and disaster resilient. If I lose my yubikey, I'd better have a physical backup copy. If I lose my keypass device, my file is just up on Dropbox. I find the value proposition is outweighed by the risk of disaster for yubikey personally, and keepass doesn't make me touch it every time so it's much more convenient…

>If I lose my keypass device, my file is just up on Dropbox. I've considered keeping my keepass file on the cloud...still wary.

Look into SyncThing
Post reply on HN