Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

engineerbetter.com

Post reply on HN
Print view View original

31–40 of 50 posts

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#31

Post by LIV2 »

peterwwillis wrote: post #2

Has anyone actually seen personal SSH or Git signing keys get stolen and used in attacks (not counting servers sitting on the internet with ssh open) ? It seems like the only really useful purpose for these tokens is as an MFA token, because passwords just suck. At the same time, it seems like long random bits that can't be remembered by humans just aren't so vulnerable that we need to carry around something to unloc…

Usually these are configured to be the private key, not unlock the one on your computer. This prevents your key being hijacked (every signing operation requires a physical button press on the key) and prevents its theft.

If an attacker can exfiltrate your private key they can probably keylog your passphrase & your VPN details

PIV/GPG smartcard solves he former and 2FA solves the latter so something like a yubikey/nitrokey gives you both in one device

Anecdotally I do have a friend who had his private key & passwords pilfered which was noticed when someone tried logging in from some other country.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#32

Post by WordyMcWordface »

32032141 wrote: post #8
peterwwillis wrote: post #2

Has anyone actually seen personal SSH or Git signing keys get stolen and used in attacks (not counting servers sitting on the internet with ssh open) ? It seems like the only really useful purpose for these tokens is as an MFA token, because passwords just suck. At the same time, it seems like long random bits that can't be remembered by humans just aren't so vulnerable that we need to carry around something to unloc…

I personally don't see the point in them at all, in implementation and reality you get basically zero use out of the things. Services that support them either have them locked down so hard that if you lose a single Yubikey (there's often no backup second key option), you're very screwed. Others go the other option, and have too easy to reset systems, SMS fallbacks, or other total bypasses of the security tokens. For…

I agree, I bought a yubi key ages ago and have tried to set it up for ssh, windows auth and various online services but I find it either just doesnt work, or works poorly enough that I don't use it and instead rely on classic TOTP instead.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#33

Post by walterbell »

JudgeWapner wrote: post #28

I wish Yubikeys supported hardware AES encryption on the device , and a hardware entropy source (vibration, rf, probably couldn't fit atomic-decay-mesurement in a usb key, but something). My personal tinfoil headwear has me believing that AES on any of the Big-2 CPU's is compromised, probably via key logging deep in the bowels of the die. And the RNG could have a similar backdoor.

> hardware AES encryption on the device

> AES on any of the Big-2 CPU's is compromised

In that case, which CPU could the Yubikey use?

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#35

Post by JudgeWapner »

walterbell wrote: post #33
JudgeWapner wrote: post #28

I wish Yubikeys supported hardware AES encryption on the device , and a hardware entropy source (vibration, rf, probably couldn't fit atomic-decay-mesurement in a usb key, but something). My personal tinfoil headwear has me believing that AES on any of the Big-2 CPU's is compromised, probably via key logging deep in the bowels of the die. And the RNG could have a similar backdoor.

> hardware AES encryption on the device > AES on any of the Big-2 CPU's is compromised In that case, which CPU could the Yubikey use?

FPGA or stock embedded CPU. I didn't mean literally any Big-2 CPU, I was thinking of desktop CPU's when I wrote that. I doubt the 8051's that you can buy by the spindle from electronics suppliers are backdoored, though its technically possible.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#36

Post by beefhash »

walterbell wrote: post #33
JudgeWapner wrote: post #28

I wish Yubikeys supported hardware AES encryption on the device , and a hardware entropy source (vibration, rf, probably couldn't fit atomic-decay-mesurement in a usb key, but something). My personal tinfoil headwear has me believing that AES on any of the Big-2 CPU's is compromised, probably via key logging deep in the bowels of the die. And the RNG could have a similar backdoor.

> hardware AES encryption on the device > AES on any of the Big-2 CPU's is compromised In that case, which CPU could the Yubikey use?

> In that case, which CPU could the Yubikey use?

Dedicated AES engines exist. For example, the 3DS shipped with a AES engine inside its SoC, exposed as memory-mapped I/O.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#37

Post by nine_k »

JudgeWapner wrote: post #35
walterbell wrote: post #33

Earlier quoted context omitted.

> hardware AES encryption on the device > AES on any of the Big-2 CPU's is compromised In that case, which CPU could the Yubikey use?

FPGA or stock embedded CPU. I didn't mean literally any Big-2 CPU, I was thinking of desktop CPU's when I wrote that. I doubt the 8051's that you can buy by the spindle from electronics suppliers are backdoored, though its technically possible.

8051s also seem pretty under-powered for a task like that.

One thing with encryption on a USB-connected security dongle is that your scp / rsync / git pull invocation is going to go through it, and through its crypto engine. To make it not painfully slow, the crypto engine has to be pretty fast. It's likely not very cheap, either using a (fast) general purpose CPU core, or using custom / specialized circuitry.

Paying extra for high security at high speed may make complete sense in some cases. For a cheap mass-market product, it's less likely.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#38

Post by tialaramex »

AdmiralAsshat wrote: post #24
tialaramex wrote: post #22

Earlier quoted context omitted.

If I understand correctly the problem you're seeing it's not a Mozilla bug Although Google's site says "Your current browser doesn't support adding security keys" what they mean is "We don't care about any browsers except Chrome, it works in Chrome, just get Chrome". They don't implement the actual standard, even though they helped write it, because after all it works in Chrome™ as it is. On sites that are built by s…

I wouldn't doubt that, although I ran into the same problem trying to register my Yubikey on GitHub as well. Could well be another "Built to Chrome spec, not the standard spec," I suppose.

Ah, for sites using U2F rather than WebAuthn you may (depending on Firefox version) need to explicitly tell Firefox to emulate the old U2F APIs.

https://support.yubico.com/support/solutions/articles/150000...

https://blog.mozilla.org/security/2019/04/04/shipping-fido-u...

My GitHub has two Security Keys registered via Firefox this way.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#39

Post by tialaramex »

EngineerBetter wrote: post #34

It's worth pointing out that AWS does now support U2F, which isn't reflected in the posts.

I had this set for my old AWS work account, but unlike a good WebAuthn implementation I'm pretty sure AWS only allowed me to a set a single key.

I tolerated that because a work account administrator can let me back in if I lose the key, but this is very much a second class implementation and I think AWS ought to do better.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#40

Post by jdfellow »

I've been using a Trezor crypto wallet for most of these things; it has password manager features but I haven't switched from LastPass for that yet.

I've even enabled U2F 2FA on my work desktop for log in, and use it as 1FA to unlock the screenlock, and it automatically locks when I unplug it. Very slick. You could do similar with YubiKey.

Post reply on HN