How to use FIDO2 USB keys with SSH • Hacker News Board

Re: How to use FIDO2 USB keys with SSH

#21

Post by microcolonel » Tue, Jun 30, 2020, 2:42 PM UTC

jjoonathan wrote: post #20

spiridow wrote: post #10

I'm really excited to see more and more people talk about FIDO2. If you're interested about this topic, I gave a talk about it yesterday: https://news.ycombinator.com/item?id=23689606

Here's a browser compatibility matrix (I know, OP is about SSH). FIDO2/U2F Just Works in: Chrome on Windows Firefox on Windows Chrome on Mac Firefox on Mac Chrome in Ubuntu 20 Firefox in Ubuntu 20 Wall of shame (FIDO2/U2F does not Just Work in): Safari EDIT: it does work out-of-the-box in Ubuntu 20, my bad.

Just Works in Chromium and Brave on Arch Linux.

Re: How to use FIDO2 USB keys with SSH

#22

Post by xenophonf » Tue, Jun 30, 2020, 2:44 PM UTC

jjoonathan wrote: post #20

spiridow wrote: post #10

I'm really excited to see more and more people talk about FIDO2. If you're interested about this topic, I gave a talk about it yesterday: https://news.ycombinator.com/item?id=23689606

Here's a browser compatibility matrix (I know, OP is about SSH). FIDO2/U2F Just Works in: Chrome on Windows Firefox on Windows Chrome on Mac Firefox on Mac Chrome in Ubuntu 20 Firefox in Ubuntu 20 Wall of shame (FIDO2/U2F does not Just Work in): Safari EDIT: it does work out-of-the-box in Ubuntu 20, my bad.

I haven't had any problems using my Yubikey in U2F or PIV modes on Ubuntu 20.04.

Re: How to use FIDO2 USB keys with SSH

#23

Post by simias » Tue, Jun 30, 2020, 2:47 PM UTC

I've been using my Yubikey in GnuPG smartcard mode for years to do the same thing, from what I can see from this tutorial FIDO2 seems a bit easier to setup initially but it also seems much less widely supported at the moment. Are there other tradeoffs to consider?

Re: How to use FIDO2 USB keys with SSH

#24

Post by jjoonathan » Tue, Jun 30, 2020, 2:48 PM UTC

xenophonf wrote: post #22

jjoonathan wrote: post #20

Earlier quoted context omitted.

Here's a browser compatibility matrix (I know, OP is about SSH). FIDO2/U2F Just Works in: Chrome on Windows Firefox on Windows Chrome on Mac Firefox on Mac Chrome in Ubuntu 20 Firefox in Ubuntu 20 Wall of shame (FIDO2/U2F does not Just Work in): Safari EDIT: it does work out-of-the-box in Ubuntu 20, my bad.

I haven't had any problems using my Yubikey in U2F or PIV modes on Ubuntu 20.04.

Confirmed and updated, thanks!

The fact that it didn't work out-of-the-box in Ubuntu 19 (needed a udev tweak) and a failing USB port on my laptop gave me the impression that it also didn't work out-of-the-box in Ubuntu 20 (which I booted from a USB key, hence the good port was unavailable), but I just tried it using my laptop's good USB port and a hub and I can now confirm that it works out-of-the-box in Ubuntu 20.

Re: How to use FIDO2 USB keys with SSH

#25

Post by jjoonathan » Tue, Jun 30, 2020, 2:49 PM UTC

microcolonel wrote: post #21

jjoonathan wrote: post #20

Earlier quoted context omitted.

Here's a browser compatibility matrix (I know, OP is about SSH). FIDO2/U2F Just Works in: Chrome on Windows Firefox on Windows Chrome on Mac Firefox on Mac Chrome in Ubuntu 20 Firefox in Ubuntu 20 Wall of shame (FIDO2/U2F does not Just Work in): Safari EDIT: it does work out-of-the-box in Ubuntu 20, my bad.

Just Works in Chromium and Brave on Arch Linux.

With or without udev tweaks? That has been the major caveat on linux in recent times.

Re: How to use FIDO2 USB keys with SSH

#26

Post by StavrosK » Tue, Jun 30, 2020, 2:49 PM UTC

simias wrote: post #23

I've been using my Yubikey in GnuPG smartcard mode for years to do the same thing, from what I can see from this tutorial FIDO2 seems a bit easier to setup initially but it also seems much less widely supported at the moment. Are there other tradeoffs to consider?

I think those are pretty much the only ones, the Yubikey in GPG smartcard mode was always too fiddly for me and interfered with my agent in other ways, but this is trivial to set up and use.

Also, a big draw of the USB SSH key for me is that I can plug it in to other computers and connect to my servers, which smartcard mode didn't do, so that was a big drawback for me.

Re: How to use FIDO2 USB keys with SSH

#27

Post by StavrosK » Tue, Jun 30, 2020, 2:51 PM UTC

jjoonathan wrote: post #20

spiridow wrote: post #10

I'm really excited to see more and more people talk about FIDO2. If you're interested about this topic, I gave a talk about it yesterday: https://news.ycombinator.com/item?id=23689606

Here's a browser compatibility matrix (I know, OP is about SSH). FIDO2/U2F Just Works in: Chrome on Windows Firefox on Windows Chrome on Mac Firefox on Mac Chrome in Ubuntu 20 Firefox in Ubuntu 20 Wall of shame (FIDO2/U2F does not Just Work in): Safari EDIT: it does work out-of-the-box in Ubuntu 20, my bad.

"Passwordless" mode unfortunately doesn't work for me in Firefox, I implemented it on https://www.pastery.net/ but I'm not sure if I did something wrong. Chrome works fine, though.

Re: How to use FIDO2 USB keys with SSH

#28

Post by StavrosK » Tue, Jun 30, 2020, 2:53 PM UTC

ta17711771 wrote: post #19

StavrosK wrote: post #8

Earlier quoted context omitted.

Same here, and I just absolutely love how well it works. Now if Android SSH apps add support for it, my SSH life will be complete.

Can you do it with Termux or T-UI somehow? Addons?

Hmm, I don't think so, but I'll look into it, thanks!

Re: How to use FIDO2 USB keys with SSH

#29

Post by DCKing » Tue, Jun 30, 2020, 2:55 PM UTC

EDIT: I misunderstood the post, and what I describe below is not true!

I'm incredibly excited about FIDO2, but this is quite underwhelming honestly. I'd like to SSH with a credential on my Yubikey, not by a credential or configuration already stored on my computer that is unlocked by my Yubikey. I'd like to be able to plug in my Yubikey anywhere and go. My Linux desktop, my Macbook, my Windows desktop, my Android phone.

- Yubikey with GPG/PIV for SSH: your Yubikey stores your private key. You can take it anywhere, plug it in, [have to go through all the setup required for your computer to talk GPG/PIV], and log in.

- Yubikey with FIDO2 for SSH: your Yubikey stores a symmetric key to unlock your private key on your computer. [You cannot take it anywhere], plug it in, don't have to set anything up if your client and server have this (eventually), and log in.

FIDO2 is solving a lot of authentication convenience problems, but not this one I think. I get that this pretty nice when integrating with Windows Hello or Apple's TouchID, but I don't think FIDO2 USB key with SSH is that great.

Re: How to use FIDO2 USB keys with SSH

#30

Post by RL_Quine » Tue, Jun 30, 2020, 3:03 PM UTC

StavrosK wrote: post #26

simias wrote: post #23

I've been using my Yubikey in GnuPG smartcard mode for years to do the same thing, from what I can see from this tutorial FIDO2 seems a bit easier to setup initially but it also seems much less widely supported at the moment. Are there other tradeoffs to consider?

I think those are pretty much the only ones, the Yubikey in GPG smartcard mode was always too fiddly for me and interfered with my agent in other ways, but this is trivial to set up and use. Also, a big draw of the USB SSH key for me is that I can plug it in to other computers and connect to my servers, which smartcard mode didn't do, so that was a big drawback for me.

You can't do that easily, you still need the public key file on disk.