Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

engineerbetter.com

Post reply on HN
Print view View original

21–30 of 50 posts

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#21

Post by bpye »

dpflan wrote: post #15
sqoopd wrote: post #5

Earlier quoted context omitted.

That is sort of the idea. It's a relatively cheap authenticator that can be bought to provide 2FA for added security for your services. You can integrate it with Gmail, Mac Logins, etc.

Yes, I'm interested in general adoption and whether general populous would adopt such a 2nd-auth if presented as a fashion item (i.e. make the authenticator more accessible).

In the UK Barclays and NatWest (maybe others) offer a card reader for 2FA for banking transactions, I assume based on something like HOTP.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#22

Post by tialaramex »

AdmiralAsshat wrote: post #9

I've got two Yubikeys already (a Neo, and an older barebones Yubikey that I got as a gift for getting an Ars Technica subscription), but so far Gmail is the only account of mine that is protected by it. One repeated problem I've run into so far is that Firefox can read the Yubikey when it's inserted but it can't add the Yubikey as a new device yet. I have to pull up Chrome/Chromium to do so. After my most recent lapt…

If I understand correctly the problem you're seeing it's not a Mozilla bug

Although Google's site says "Your current browser doesn't support adding security keys" what they mean is "We don't care about any browsers except Chrome, it works in Chrome, just get Chrome". They don't implement the actual standard, even though they helped write it, because after all it works in Chrome™ as it is.

On sites that are built by somebody who actually cares about more than one browser, Firefox works just fine.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#23

Post by [deleted] »

32032141 wrote: post #8
peterwwillis wrote: post #2

Has anyone actually seen personal SSH or Git signing keys get stolen and used in attacks (not counting servers sitting on the internet with ssh open) ? It seems like the only really useful purpose for these tokens is as an MFA token, because passwords just suck. At the same time, it seems like long random bits that can't be remembered by humans just aren't so vulnerable that we need to carry around something to unloc…

I personally don't see the point in them at all, in implementation and reality you get basically zero use out of the things. Services that support them either have them locked down so hard that if you lose a single Yubikey (there's often no backup second key option), you're very screwed. Others go the other option, and have too easy to reset systems, SMS fallbacks, or other total bypasses of the security tokens. For…

[deleted]

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#24

Post by AdmiralAsshat »

tialaramex wrote: post #22
AdmiralAsshat wrote: post #9

I've got two Yubikeys already (a Neo, and an older barebones Yubikey that I got as a gift for getting an Ars Technica subscription), but so far Gmail is the only account of mine that is protected by it. One repeated problem I've run into so far is that Firefox can read the Yubikey when it's inserted but it can't add the Yubikey as a new device yet. I have to pull up Chrome/Chromium to do so. After my most recent lapt…

If I understand correctly the problem you're seeing it's not a Mozilla bug Although Google's site says "Your current browser doesn't support adding security keys" what they mean is "We don't care about any browsers except Chrome, it works in Chrome, just get Chrome". They don't implement the actual standard, even though they helped write it, because after all it works in Chrome™ as it is. On sites that are built by s…

I wouldn't doubt that, although I ran into the same problem trying to register my Yubikey on GitHub as well. Could well be another "Built to Chrome spec, not the standard spec," I suppose.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#26

Post by lmm »

dpflan wrote: post #3

Does anyone use a Yubikey for personal rather than business/employment situations? Would a Yubikey ring make any sense for personal use (for example, you have Yubikey ring that connects via NFC with your device (phone, computer) and is require for auth'ing financial transactions?

I use a Feitian epass for my personal accounts (it seems like yubikeys are USB or NFC whereas I wanted a single key that would do both). It fits on my keyring (smaller than my house key) and claims to be waterproof. I wish I could use something like that for banking - it's much more convenient than the little card readers some banks use, and frankly I have more faith in its security. A ring form factor would be nice, but I don't think NFC on PCs is ubiquitous enough yet.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#27

Post by peterwwillis »

32032141 wrote: post #8
peterwwillis wrote: post #2

Has anyone actually seen personal SSH or Git signing keys get stolen and used in attacks (not counting servers sitting on the internet with ssh open) ? It seems like the only really useful purpose for these tokens is as an MFA token, because passwords just suck. At the same time, it seems like long random bits that can't be remembered by humans just aren't so vulnerable that we need to carry around something to unloc…

I personally don't see the point in them at all, in implementation and reality you get basically zero use out of the things. Services that support them either have them locked down so hard that if you lose a single Yubikey (there's often no backup second key option), you're very screwed. Others go the other option, and have too easy to reset systems, SMS fallbacks, or other total bypasses of the security tokens. For…

Well their main use is to mitigate remote compromise. But I suppose if for some reason someone compromises a private key remotely (???), they don't have your physical 2nd key to complete auth. Or if you want encryption at rest with something stronger than a passphrase. For weird cases like "disk backup was compromised" it also helps, because most people don't encrypt backups at the client. But in general, actual protection seems vanishingly small past remote attacks.

So I think in general private keys aren't improved with a token, since a compromised private key is supposed to be a local compromise.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#28

Post by JudgeWapner »

I wish Yubikeys supported hardware AES encryption on the device, and a hardware entropy source (vibration, rf, probably couldn't fit atomic-decay-mesurement in a usb key, but something).

My personal tinfoil headwear has me believing that AES on any of the Big-2 CPU's is compromised, probably via key logging deep in the bowels of the die. And the RNG could have a similar backdoor.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#29

Post by LIV2 »

tomatocracy wrote: post #16
m3nu wrote: post #10

(Title needs the year since the article is from 2017.) For keeping SSH keys, the PIV module seems a bit simpler than GPG. I just went through the process myself.[1] They should also mention FIDO U2F, which already works well with Google, AWS and Github among others. Implementing it for your own site also seems doable. 1: https://blog.snapdragon.cc/2019/04/27/using-a-yubikey-to-sec...

Agreed - in particular because PIV doesn’t prevent other apps subsequently using the device as gpg-agent does (necessitating unplugging and replacing it in the USB port). On the flip side, with PIV there’s no way I’ve seen to have it allow access for a short period of time (eg the way gpg can cache the pin for a set number of seconds) instead of per request which can get a bit annoying if you are invoking ssh repeate…

You can configure "--touch-policy=cached" when importing/generating a private key using the cli PIV management utility which will cache touches for 10 seconds Not sure why it's not exposed in the GUI though

https://developers.yubico.com/yubico-piv-tool/Manuals/yubico...

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#30

Post by EngineerBetter »

m3nu wrote: post #10

(Title needs the year since the article is from 2017.) For keeping SSH keys, the PIV module seems a bit simpler than GPG. I just went through the process myself.[1] They should also mention FIDO U2F, which already works well with Google, AWS and Github among others. Implementing it for your own site also seems doable. 1: https://blog.snapdragon.cc/2019/04/27/using-a-yubikey-to-sec...

Apologies - I updated the post today to include the commit signing, and didn't think about the date of the parent post.
Post reply on HN