I really would like to use it, but without ability to backup it, I don't wanna. I've read some time ago Yubikey of some other company showed initial spec, but I never heard any followup, I don't remember the link. For now I'm using TOTP but it's a chore. Salesforce Authenticator has nice idea with custom push-based protocol, but it's not running on dedicated hardware. I think ESP32 S3 has hardware potential to act as security has as it has e-fuses and has enough umph for cryptography, it would be interesting option to see (maybe with optional wifi/bluetooth faraday cage on it)
How to Yubikey
21–30 of 186 posts
Re: How to Yubikey
#22I was hoping to find how to change the number of GPG passphrase/PIN retries (the default of 3 is panic-inducing after just fat fingering it once) - I did it on one of mine some time ago, but haven't been able to figure it out again recently for another one. Sorry, it's a bit of a tangent, but if anyone happens to know?
According to this: * https://github.com/drduh/YubiKey-Guide#configure-smartcard ... it is: gpg --card-edit
Ah, thanks, it is described at the bottom of that section, but it's actually:
ykman openpgp access set-retries 5 5 5 -f -a YOUR_ADMIN_PIN
Now, do I know my admin PIN...
Re: How to Yubikey
#23I really would like to use it, but without ability to backup it, I don't wanna. I've read some time ago Yubikey of some other company showed initial spec, but I never heard any followup, I don't remember the link. For now I'm using TOTP but it's a chore. Salesforce Authenticator has nice idea with custom push-based protocol, but it's not running on dedicated hardware. I think ESP32 S3 has hardware potential to act as…
The backup plan is mostly having a backup key. The whole point is that there's a secret inside the key that can't be stolen, and that means there's no way of exporting it either. Most services I deal with allow registering multiple keys. Some like Paypal don't, but allow having both a key and TOTP so you can use TOTP as a fallback.
For convenient TOTP, you can try this one: https://www.themooltipass.com/
It mostly acts as a keyboard (bluetooth or USB). It supports TOTP, and will type it out for you. It has an internal battery and for TOTP the clock is set by the management application for it.
Re: How to Yubikey
#24I really would like to use it, but without ability to backup it, I don't wanna. I've read some time ago Yubikey of some other company showed initial spec, but I never heard any followup, I don't remember the link. For now I'm using TOTP but it's a chore. Salesforce Authenticator has nice idea with custom push-based protocol, but it's not running on dedicated hardware. I think ESP32 S3 has hardware potential to act as…
> I really would like to use it, but without ability to backup it, I don't wanna.
> For now I'm using TOTP but it's a chore.
TOTP is your backup, I'd say most sites don't allow WebAuthn without TOTP enabled first.
Re: How to Yubikey
#25Earlier quoted context omitted.
>a backup >convenience I always wonder how often someone gets into a crisis because their Yubikey breaks while they're at, say, a conference (ie. far away from the backup, be it another key, or access to recover codes). I recon they can just break when plugged into a laptop that takes a dive.
Most people have only their phones, which can also break. But some people only start thinking about that stuff when they look at alternatives like the Yubikey. > they can just break when plugged into a laptop that takes a dive So can the laptop at a conference. Or anything else really. I just remove my Yubikey after use and carry it in my wallet when not in use. Sure, I can lose my wallet, but I have multiple back-up…
In normal life losing access to your phone won't lock you out of everything. You still have all your other devices you can use AND you can always just walk into store and buy yourself a replacement and download your phone back from a backup.
Same with laptops. If you go to a conference and your laptop breaks. You can just go to nearest store and buy a new one. It will take couple hours, but you'll be up and running again.
With security key if you lose it you lose access immediately to your stuff and you probably can not get a new one with in 24 hours even if money wasn't an issue. Also after you get the key there is no way to authenticate yourself to the key in a way that you can just make it a copy of your previous key.
Wallet is the best example. If you lose your wallet you need to kill your credit cards and get a new ID. However this does not lock you out of anything. You can go to your bank and take out whatever amount of money you need and order a new card, this will be inconvenient for about week. With your ID it depends on the schedules. However there is clear path to recovery.
Re: How to Yubikey
#26I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.
>a backup >convenience I always wonder how often someone gets into a crisis because their Yubikey breaks while they're at, say, a conference (ie. far away from the backup, be it another key, or access to recover codes). I recon they can just break when plugged into a laptop that takes a dive.
I've been using them for a long time and so far it's never happened, but yeah, the USB A version looks potentially vulnerable.
The USB C version looks more solidly made.
Re: How to Yubikey
#27While having a YK neo with all the features, I prefer the simple FIDO security key. Everything you could want apart from legacy/special use cases can be achieved with fido.
websites -> fido/u2f ssh -> native fido support in ssh-keygen login -> fido2 for windows, libpam-u2f for linux luks encryption -> systemd-cryptenroll
Re: How to Yubikey
#28Your paranoia is getting out of hand, seriously.
2FA here, OTP there.
Idk about you, maybe you do have such sensitive data that you have to double guard everything, I and the usual average guy doesn't.
Why do I care? Because this craze has already reached the real world. Amazon requiring 2FA on deliveries. Wtf is wrong with my passport or other document? Nothing. Now I have to be physically present and recite some fucking code they sent my via fucking email or app if installed.
I can't log in anywhere anymore without having to double prove that the password and email is indeed mine. STOP THIS MADNESS ALREADY!
Re: How to Yubikey
#29Your paranoia is getting out of hand, seriously. 2FA here, OTP there. Idk about you, maybe you do have such sensitive data that you have to double guard everything, I and the usual average guy doesn't. Why do I care? Because this craze has already reached the real world. Amazon requiring 2FA on deliveries. Wtf is wrong with my passport or other document? Nothing. Now I have to be physically present and recite some fu…
My work recently changed the password length requirement to 16 characters, 2FA now requires typing in a number and you automatically get deauthenticated every 12 hours.
I really feel there's got to be diminishing returns for such policies
Re: How to Yubikey
#30Your paranoia is getting out of hand, seriously. 2FA here, OTP there. Idk about you, maybe you do have such sensitive data that you have to double guard everything, I and the usual average guy doesn't. Why do I care? Because this craze has already reached the real world. Amazon requiring 2FA on deliveries. Wtf is wrong with my passport or other document? Nothing. Now I have to be physically present and recite some fu…
I really hope PassKeys will be implemented everywhere soon.