Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

engineerbetter.com

Post reply on HN
Print view View original

41–50 of 50 posts

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#41

Post by tialaramex »

peterwwillis wrote: post #2

Has anyone actually seen personal SSH or Git signing keys get stolen and used in attacks (not counting servers sitting on the internet with ssh open) ? It seems like the only really useful purpose for these tokens is as an MFA token, because passwords just suck. At the same time, it seems like long random bits that can't be remembered by humans just aren't so vulnerable that we need to carry around something to unloc…

So, taking "personal" to mean specifically that they belong to an individual as opposed to a service account, yes, that definitely has happened in real security incidents with big consequences.

There's a 2008 Fedora incident of this sort, a Fedora Administrator's private key was "stolen" by bad guys and used to upload replacement packages which is well documented e.g. https://lwn.net/Articles/326170/.

I think we should assume that this has also happened plenty of times to organisations which have a default posture of not telling you about incidents at all unless required by law.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#43

Post by [deleted] »

AdmiralAsshat wrote: post #24
tialaramex wrote: post #22

Earlier quoted context omitted.

If I understand correctly the problem you're seeing it's not a Mozilla bug Although Google's site says "Your current browser doesn't support adding security keys" what they mean is "We don't care about any browsers except Chrome, it works in Chrome, just get Chrome". They don't implement the actual standard, even though they helped write it, because after all it works in Chrome™ as it is. On sites that are built by s…

I wouldn't doubt that, although I ran into the same problem trying to register my Yubikey on GitHub as well. Could well be another "Built to Chrome spec, not the standard spec," I suppose.

[deleted]

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#44

Post by ryukafalz »

tomatocracy wrote: post #16
m3nu wrote: post #10

(Title needs the year since the article is from 2017.) For keeping SSH keys, the PIV module seems a bit simpler than GPG. I just went through the process myself.[1] They should also mention FIDO U2F, which already works well with Google, AWS and Github among others. Implementing it for your own site also seems doable. 1: https://blog.snapdragon.cc/2019/04/27/using-a-yubikey-to-sec...

Agreed - in particular because PIV doesn’t prevent other apps subsequently using the device as gpg-agent does (necessitating unplugging and replacing it in the USB port). On the flip side, with PIV there’s no way I’ve seen to have it allow access for a short period of time (eg the way gpg can cache the pin for a set number of seconds) instead of per request which can get a bit annoying if you are invoking ssh repeate…

>Agreed - in particular because PIV doesn’t prevent other apps subsequently using the device as gpg-agent does (necessitating unplugging and replacing it in the USB port).

I believe this is no longer the case? At least with current GPGTools on macOS, I leave a Yubikey Nano in one of my USB ports and use it for both GPG and U2F without issue.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#45

Post by ryukafalz »

m3nu wrote: post #10

(Title needs the year since the article is from 2017.) For keeping SSH keys, the PIV module seems a bit simpler than GPG. I just went through the process myself.[1] They should also mention FIDO U2F, which already works well with Google, AWS and Github among others. Implementing it for your own site also seems doable. 1: https://blog.snapdragon.cc/2019/04/27/using-a-yubikey-to-sec...

>For keeping SSH keys, the PIV module seems a bit simpler than GPG.

If you're only using it for SSH, sure. If you also want commit signing, though, you'll need to set up GPG anyway.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#46

Post by 32032141 »

peterwwillis wrote: post #27
32032141 wrote: post #8

Earlier quoted context omitted.

I personally don't see the point in them at all, in implementation and reality you get basically zero use out of the things. Services that support them either have them locked down so hard that if you lose a single Yubikey (there's often no backup second key option), you're very screwed. Others go the other option, and have too easy to reset systems, SMS fallbacks, or other total bypasses of the security tokens. For…

Well their main use is to mitigate remote compromise. But I suppose if for some reason someone compromises a private key remotely (???), they don't have your physical 2nd key to complete auth. Or if you want encryption at rest with something stronger than a passphrase. For weird cases like "disk backup was compromised" it also helps, because most people don't encrypt backups at the client. But in general, actual prot…

I don't really see a situation in which someone has local file read access on your machine, but doesn't otherwise have you completely owned.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#47

Post by zxcvbn4038 »

tialaramex wrote: post #22
AdmiralAsshat wrote: post #9

I've got two Yubikeys already (a Neo, and an older barebones Yubikey that I got as a gift for getting an Ars Technica subscription), but so far Gmail is the only account of mine that is protected by it. One repeated problem I've run into so far is that Firefox can read the Yubikey when it's inserted but it can't add the Yubikey as a new device yet. I have to pull up Chrome/Chromium to do so. After my most recent lapt…

If I understand correctly the problem you're seeing it's not a Mozilla bug Although Google's site says "Your current browser doesn't support adding security keys" what they mean is "We don't care about any browsers except Chrome, it works in Chrome, just get Chrome". They don't implement the actual standard, even though they helped write it, because after all it works in Chrome™ as it is. On sites that are built by s…

This is why you don’t do feature detection with the user agent header, but someone needs to tell that to the 800 lb gorilla. In this case though I’m not going to be too harsh because Mozilla wasn’t exactly tripping over themselves to implement U2F support - I think it took them 2-3 years, and I still can’t use a key with any of my IOS browsers (which I think are all just window dressing for apple’s html widget, so blame that on Apple).

Web site support that uses the feature on any browser has been slow also. Robinhood is the only financial app that I’ve found that even supports TOTP. My E-trade account still requires a hardware token with a little lcd screen on it - paging Captain Marvel.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#48

Post by dcbadacd »

32032141 wrote: post #46
peterwwillis wrote: post #27

Earlier quoted context omitted.

Well their main use is to mitigate remote compromise. But I suppose if for some reason someone compromises a private key remotely (???), they don't have your physical 2nd key to complete auth. Or if you want encryption at rest with something stronger than a passphrase. For weird cases like "disk backup was compromised" it also helps, because most people don't encrypt backups at the client. But in general, actual prot…

I don't really see a situation in which someone has local file read access on your machine, but doesn't otherwise have you completely owned.

A regular keylogger won't no longer work with a hardware token for example. Yes, having your PC compromised is bad but it would be even worse if the keys can be stolen and used elsewhere, it just rises the bar significantly for getting persistent access (re-establishment without the token is really hard) in my opinion.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#49

Post by bradstewart »

tialaramex wrote: post #39
EngineerBetter wrote: post #34

It's worth pointing out that AWS does now support U2F, which isn't reflected in the posts.

I had this set for my old AWS work account, but unlike a good WebAuthn implementation I'm pretty sure AWS only allowed me to a set a single key. I tolerated that because a work account administrator can let me back in if I lose the key, but this is very much a second class implementation and I think AWS ought to do better.

It's true. You can only set one 2FA factor on an IAM account. As a work around, I ended up making myself two IAM accounts: one tied to primary Yubikey and another to my backup. Certainly not ideal.

Re: Yubikey guide for Git Signing, SSH Auth, U2F 2FA, and 1Password (2017)

#50

Post by nijave »

32032141 wrote: post #8
peterwwillis wrote: post #2

Has anyone actually seen personal SSH or Git signing keys get stolen and used in attacks (not counting servers sitting on the internet with ssh open) ? It seems like the only really useful purpose for these tokens is as an MFA token, because passwords just suck. At the same time, it seems like long random bits that can't be remembered by humans just aren't so vulnerable that we need to carry around something to unloc…

I personally don't see the point in them at all, in implementation and reality you get basically zero use out of the things. Services that support them either have them locked down so hard that if you lose a single Yubikey (there's often no backup second key option), you're very screwed. Others go the other option, and have too easy to reset systems, SMS fallbacks, or other total bypasses of the security tokens. For…

I think they can be pretty beneficial in corporate environments where you can exert some control over the IDP and turning it on/off isn't super difficult (like visiting a physical help desk)

In addition, these places tend to have less technical users and "plug it in and press during login" isn't terribly difficult

Post reply on HN