Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using a Yubikey as a touchless, magic unlock key for Linux

kliu.io

Post reply on HN
Print view View original

21–30 of 74 posts

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#21

Post by GekkePrutser »

ComodoHacker wrote: post #7

The main drawback of this method if used daily would be broken USB ports.

Yeah besides contactless being an option as the other poster said (I use this too sometimes, especially on my phone), at work I use a cheap USB hub for this. When a port dies or becomes unreliable, I tape it off and use the next one. It can be really cheap as USB 2.0 is more than fast enough for a yubikey.

I'm at 2 out of 4 ports dead now after 1,5 years on a $10 hub so it's not bad :) In addition, it's an iMac and the ports at the back are a nightmare to use. I taped the hub to the 'foot' of the iMac so it's much easier to use.

I don't use this mode though but PIV + PIN.

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#23

Post by munchbunny »

Pneumaticat wrote: post #14
traceroute66 wrote: post #4

I stopped reading at the first paragraph: "At that point, anyone can take the key and use it for 2-factor authentication/SSH/GPG signing, so it’s not much better than just using a normal password.". If the author hasn't figured out you can assign a PIN to the keys you store on the Yubi, then I don't see why I should waste my time reading their rambling blog post. Good luck taking my Yubikey and trying to SSH to my ki…

Author of the post here - you have a good point with regard to SSH/GPG. (I do have a PIN on my keys.) I was targeting more the U2F standpoint - as in if you're using it for 2FA, it's obviously no better than a password if someone else can just press the little yellow button :) Thanks for reading, though, and for commenting!

it's obviously no better than a password if someone else can just press the little yellow button :)

If you're using it as a second factor via U2F, the point isn't to be better than a password or to replace a password. The point is to be different. Specifically, the point is to be proof of physical possession. If they steal it, then you still have a memorized password as an authentication barrier.

The problem you raise in your blog post is a good one. People do tend to forget their security keys in their computers. However, making the security key the only required factor seems counterproductive. As an alternative, how about a background daemon that enumerates attached U2F/FIDO devices and reminds you to remove anything that's left in for more than a couple minutes?

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#24

Post by Xylakant »

ComodoHacker wrote: post #7

The main drawback of this method if used daily would be broken USB ports.

I’ve been using yubikeys for at least the last 2-3 years for all ssh/gpg operations and I have my key on my actual keychain so there’s extra weight on it and sometimes the key sits at a bit of an angle. Still, I have yet to break a single USB port on my ThinkPad. I’m a bit worried about USB-C though.

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#25

Post by aborsy »

GekkePrutser wrote: post #19

Sounds good, but I'd really want to use a PIN with that. Otherwise anyone can take my key and walk up to the computer and unlock it. I wonder if there is something like pam_piv? I use PIV already for Mac & Windows... Suppose I should look for it myself :)

You need a pin for GPG. Note that, that would protect only the gpg keys.

Don’t forget to set a password also for the YubiKey Authenticator app. Otherwise I believe anyone who has your key would see the websites with which you have Fido U2F and use it.

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#27

Post by dang »

traceroute66 wrote: post #15
quadrifoliate wrote: post #6

Earlier quoted context omitted.

> If the author hasn't figured out you can assign a PIN to the keys you store on the Yubi, then I don't see why I should waste my time reading their rambling blog post. Try being a little nicer. If you feel that the blog post is a waste of your time, here's a revolutionary idea – don't say anything? There are 29 other posts on the front page, maybe one of those other ones will be worth your time. As it is, the UX of…

The point is the author of the blog is spreading FUD by saying "you can't leave your Yubikey unattended because anybody can take it and use it to SSH without your consent". That is a falsehood and deserves to be called out. I don't mind "revolutionary ideas", but don't use your platform to spread FUD.

It's great to correct falsehoods, but please do so without "calling out". The online callout/shaming culture has toxic effects and we're on a different trip here, or trying to be.

https://hn.algolia.com/?query=online%20shaming%20by%3Adang&s...

https://news.ycombinator.com/newsguidelines.html

p.s. https://news.ycombinator.com/item?id=24190704 was much nicer - that's the spirit ;)

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#28

Post by kayodelycaon »

I think the concept is really cool and it’s awesome that Linux makes it relatively easy to play around with authentication methods. I love this kind of stuff.

But I’m also a pragmatist. While I run Linux everywhere I reasonably can, my daily driver is macOS and I can’t help but wonder if a fingerprint reader would be a better solution.

On my Mac, the fingerprint reader can unlock the system immediately and works across the operating system for root access, including sudo. (There’s a pam module.)

Locking can be done OS-wide using a keystroke (Cmd+Crtl+Q), touchbar button, or by closing the lid.

Windows has had similar capabilities far longer than macOS.

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#30

Post by kayodelycaon »

aborsy wrote: post #26
luizfelberti wrote: post #2

This is really cool, but I still feel betrayed cause when I read "touchless" and "contactless" I thought this was gonna use NFC

Which NFC? Almost no laptop has nfc reader. I am not sure if the situation is different with PCs.

It’s not NFC, but macOS uses Bluetooth for Apple Watch unlocking.

Sadly, it’s slow and unreliable.

Post reply on HN