How to Yubikey • Hacker News Board

Re: How to Yubikey

#161

Post by aranelsurion » Sat, Mar 11, 2023, 2:32 PM UTC

lakomen wrote: post #28

Your paranoia is getting out of hand, seriously. 2FA here, OTP there. Idk about you, maybe you do have such sensitive data that you have to double guard everything, I and the usual average guy doesn't. Why do I care? Because this craze has already reached the real world. Amazon requiring 2FA on deliveries. Wtf is wrong with my passport or other document? Nothing. Now I have to be physically present and recite some fu…

> Amazon requiring 2FA on deliveries.

That's probably not about information security, it's simply Amazon not trusting the gig economy delivery worker enough with an expensive package, so they give you a number only you know and he doesn't, and that's how they verify that he has to interact with you before marking the delivery as done. It's to prevent a common kind of theft.

(I'm not talking out of any inside knowledge on the process, just thought that'd be the reason)

Re: How to Yubikey

#162

Post by aranelsurion » Sat, Mar 11, 2023, 2:34 PM UTC

ryokeken wrote: post #49

lakomen wrote: post #28

Your paranoia is getting out of hand, seriously. 2FA here, OTP there. Idk about you, maybe you do have such sensitive data that you have to double guard everything, I and the usual average guy doesn't. Why do I care? Because this craze has already reached the real world. Amazon requiring 2FA on deliveries. Wtf is wrong with my passport or other document? Nothing. Now I have to be physically present and recite some fu…

where does amazon requires 2fa for deliveries or be present for it? in nj/ny doesn't seem to happen

in Germany they do, but afaict usually only for expensive packages.

Re: How to Yubikey

#163

Post by hot_gril » Sat, Mar 11, 2023, 6:00 PM UTC

Melatonic wrote: post #158

hot_gril wrote: post #134

Earlier quoted context omitted.

Same, I only use the key when something forces me to, cause I trust TOTP authentication apps even less. (I don't mean trusting that nobody hacks it, I mean trusting that I don't get locked out.)

Thankfully now with Google Authenticator at least you can export the config to another device. I periodically do this to my old Android phone so I have a backup device in case I destroy my current one

Yeah but I already wrote off Goog Authenticator after last time. The original version didn't let you transfer codes, and the devs said that's WAI for so long before listening to common sense.

Also, such a strict auth system needs to be 100% clear what my credentials are and where they're stored, and it's unclear here. People today still get confused about whether or not Android or iPhone backups (local or cloud) contain them. They could've taken a page from the cryptocurrency wallets, which give you a recovery word-list upon first setup and force you to understand how it works.

Re: How to Yubikey

#164

Post by SomeHacker44 » Sat, Mar 11, 2023, 10:01 PM UTC

nextlevelwizard wrote: post #12

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

I found that four were the right number of keys, not two. One for the permanent safe, one for the keyring, one for offsite storage at another location (like office) and one to leave in the computer.

Re: How to Yubikey

#165

Post by computerfriend » Sun, Mar 12, 2023, 5:41 AM UTC

OJFord wrote: post #22

upofadown wrote: post #18

Earlier quoted context omitted.

According to this: * https://github.com/drduh/YubiKey-Guide#configure-smartcard ... it is: gpg --card-edit

Ah, thanks, it is described at the bottom of that section, but it's actually: ykman openpgp access set-retries 5 5 5 -f -a YOUR_ADMIN_PIN (5 5 5 being the number of retries for encrypt/sign/auth) Now, do I know my admin PIN...