Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Store an SSH Key on a Yubikey

xeiaso.net

Post reply on HN
Print view View original

31–40 of 154 posts

Re: How to Store an SSH Key on a Yubikey

#31

Post by phaer »

aborsy wrote: post #24
phaer wrote: post #9

Earlier quoted context omitted.

I think the official recommendation is to store a second yubikey in a safe location. Personally I just generated my key offline (on a tails livecd) and backed it up to two different LUKS-encrypted USB sticks. One of those is stored at my place and another one at a trusted person, in case my flat burns down or so. The yubikey itself only stores subkeys, my master key stays on said USB sticks. Been using this setup for…

No need for LUKS usb. Gpg stores private keys encrypted with a password. At that point, you can store the encrypted key anywhere.

Ah yes good point for the gpg key itself, but I store a few other important secrets there as well ;)

Re: How to Store an SSH Key on a Yubikey

#32

Post by ikornaselur »

moontear wrote: post #13

OT: what kind of date format is used in the article? It says „M05 27 2022“ and I have not seen that before. Does M05 mean May-05, so basically saying may-may?

I guess it's to clear the confusion of, for example, what date would "04 07 2022" be, is that 4th of July or April 7th?

"M05 27 2022" seems to indicate that it's in fact MM DD YYYY not DD MM YYYY

Re: How to Store an SSH Key on a Yubikey

#33

Post by orev »

lordnacho wrote: post #28
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

If your whole life is on your phone like me, just attach a yubi to your actual keychain (which is stuck to your phone) and then you'll always be thinking about where your phone/wallet/keys/security are all the time. Then put the second key on your desk. My yubi happens to be annoying to fiddle with since it's on my keychain, so I use the desk one for signing most of the time. If there's a house fire, you'll have your…

Keychain stuck to your phone? I don’t think I’ve ever seen anyone with a setup like that. Sounds incredibly annoying.

Re: How to Store an SSH Key on a Yubikey

#34

Post by gruturo »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

You're not wrong, but this is exactly the use case for a USB security stick. The key is in there, cannot be extracted in any way*, can only be "used" (not accessed or copied, just used for crypto operations) while the stick is plugged in, and without it it's impossible to proceed.

It kind of goes without saying that losing the key results in you getting locked out - if there was any other way there wouldn't really be much of a point to the complication of making yourself dependent on a stick.

As a backup, you either have some kind of spare keys in safe storage or reliable access to someone who can restore your access after having identified you.

* in some case you could generate the key beforehand on a computer, and then load it on a stick (unsure about yubikeys though). You should still revoke your key anyway once your stick is lost - as you should assume it could be found and used, sometimes needing only a touch operation rather than a PIN.

Re: How to Store an SSH Key on a Yubikey

#35

Post by lordnacho »

orev wrote: post #33
lordnacho wrote: post #28

Earlier quoted context omitted.

If your whole life is on your phone like me, just attach a yubi to your actual keychain (which is stuck to your phone) and then you'll always be thinking about where your phone/wallet/keys/security are all the time. Then put the second key on your desk. My yubi happens to be annoying to fiddle with since it's on my keychain, so I use the desk one for signing most of the time. If there's a house fire, you'll have your…

Keychain stuck to your phone? I don’t think I’ve ever seen anyone with a setup like that. Sounds incredibly annoying.

Well I've only got one key on the chain, though my wife has a couple of them. Nothing too cumbersome, plus I have a strap that's useful for pulling the phone out of my pocket.

Re: How to Store an SSH Key on a Yubikey

#36

Post by yakak »

BoppreH wrote: post #22
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

That's a very good question and in my opinion the biggest flaw with almost all new 2FA/passwordless systems. The "best practice" is to get a second yubikey or store recovery codes on paper, but that requires keeping them close to you because you'll need to update your backup on every new signup. That makes these systems entirely useless at protecting against house fires, signups while away from home, or simply servic…

I think people start with trying to do the best practice too early. Just using one key as your primary authentication adds a lot of security as other authentication methods aren't as routinely exposed. That's enough to get started and makes it easier to think about backups when one is ready for multiple keys.

Re: How to Store an SSH Key on a Yubikey

#37

Post by cuu508 »

rgoulter wrote: post #27
artdigital wrote: post #17

Earlier quoted context omitted.

I have a question - do you disable regular OTP 2FA on services you use the Yubikey? I have one too and religiously added it to all kinds of things, but each service allowed me to just skip the yubikey when a regular OTP code was entered, effectively making me not use the yubikey

If you have only one Yubikey, and use it as the only factor of authentication to a website, you'll need to ensure you store the 2FA recovery codes safely. Whereas, if you have both Yubikey and TOTP as factors of authentication, if you lose the Yubikey, you'll still be able to login. I view that as "Yubikey more convenient than TOTP". You can either use TOTP, or the Yubikey, and it's easier to tap a button than to ent…

WebAuthn is more convenient but also more secure. You don't have to be as vigilant when checking what URL your browser is pointing at.

Re: How to Store an SSH Key on a Yubikey

#38

Post by archi42 »

> This should work on other FIDO keys like Google's Titan, but we don't have access to one over here and as such haven't tested it.

For my trusty HyperFIDO Mini (usb id 0x2ccf:0x0880) this doesn't work, though it's rather old (1st gen) and maybe they refreshed it to support this. ssh-keygen fails with "Key enrollment failed: requested feature not supported". I wanted to replace it with a USB-C (& maybe NFC) device anyway, so seems like a good opportunity.

Re: How to Store an SSH Key on a Yubikey

#39

Post by [deleted] »

gruturo wrote: post #34
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

You're not wrong, but this is exactly the use case for a USB security stick. The key is in there, cannot be extracted in any way*, can only be "used" (not accessed or copied, just used for crypto operations) while the stick is plugged in, and without it it's impossible to proceed. It kind of goes without saying that losing the key results in you getting locked out - if there was any other way there wouldn't really be…

[deleted]

Re: How to Store an SSH Key on a Yubikey

#40

Post by izacus »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

You obviously keep backups (either in form of another YubiKey or backup codes). That's just common sense, you don't only have a single house key either right?
Post reply on HN