Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardware Touch, Stronger SSH

ubicloud.com

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Hardware Touch, Stronger SSH

#41

Post by DetectDefect »

solatic wrote: post #34
DetectDefect wrote: post #23

Earlier quoted context omitted.

If you aready have an SSH CA, why not just issue ephemeral certs lasting for several seconds or minutes? What risk would be addressed by adding hardware keys into the mix?

How do you prevent malware running on the pwned laptop from asking for an ephemeral cert to be issued? How do you know a human being is in the loop? Usually ephemeral sessions are up to 15 minutes (also to deal with misaligned clocks and unhappy users) - plenty of time for malware to ship the cert back to a command-and-control server. This is the key advantage of hardware keys, the fact that the physical press is req…

> How do you prevent malware running on the pwned laptop from asking for an ephemeral cert to be issued?

If you have malware capable of code execution, restricting the ability to issue one command is not going to be a meaningful control, especially with something like a physical touch which most users are just conditioned to accept, or can be trivially phished into accepting.

> plenty of time for malware to ship the cert back to a command-and-control server.

If your infrastructure cannot distinguish legitimate traffic, or you do not have a defensible network perimeter, again a physical touch is not going to be meaningful; it is not the panacea you are looking for.

Re: Hardware Touch, Stronger SSH

#42

Post by talkingtab »

gruez wrote: post #29
talkingtab wrote: post #12

In my opinion only, Yubico has done no favors to the Fido by their marketing. A result of trying to make Yubikey synonymous with Fido, it has become unclear what Fido does. And as a result of how they market their keys, decisions Fido keys are presented with a cost of $20 - $60. Why $60, for a simple Fido key? Because for $60 you get not only Fido, but Flippo, Froggo, x.6s8o and more-o. The result is that most people…

>I am not pointing at Yubico as they have done well making profits from corporations. Rather the Fido Alliance. Looking at the Fido Alliance provides a first pass at answering the question "Who Benefits?" > https://fidoalliance.org/overview/leadership/ >Perhaps it is fair to ask "What benefit" as well. >Corpocracy. You gotta love it. You're really beating around the bush, trying to imply there's something shady going…

This is not a conspiracy. This is just corporations acting in their best interest. Exactly the same as MicroSoft acted in their best interest as described here: https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor....

If that is confusing here is link to the Friedman Doctrine that explains it. https://en.wikipedia.org/wiki/Friedman_doctrine

When we see a technology that appears beneficial and is not adopted, I think it is fair to wonder why that is.

For me the key points I ponder are:

- over several years I saw articles on HN that supposedly promoted Fido, but almost always they talked about Yubikeys. This continues.

- Solokeys built an open source Fido key. They were priced very low compared to Yubikeys, but functioned just as well. You could buy them on Amazon at one point (and I did)

- the Fido Alliance Accreditation fees https://fidoalliance.org/certification/authenticator-certifi...

So no. I do not see a conspiracy, I just see an array of corporations acting according to the Friedman Doctrine.

Perhaps a good question is what benefits might those corporations gain from their actions. Would Google and Apple benefit from broad adoption of Fido keys or would it somehow lessen their profits? I don't know the answer, but I know the question.

Re: Hardware Touch, Stronger SSH

#43

Post by machinationu »

ComputerGuru wrote: post #35
the8472 wrote: post #31

Earlier quoted context omitted.

Couldn't they ship pre-compromised? Storing the RNG seed and private key at the factory.

Devil’s advocate: How do they map that data to a user when you are buying through a maze of resellers?

they dont, they try against all the keys, there are at most a few billion of them

see Dual_EC_DRBG

Re: Hardware Touch, Stronger SSH

#44

Post by gruez »

talkingtab wrote: post #42
gruez wrote: post #29

Earlier quoted context omitted.

>I am not pointing at Yubico as they have done well making profits from corporations. Rather the Fido Alliance. Looking at the Fido Alliance provides a first pass at answering the question "Who Benefits?" > https://fidoalliance.org/overview/leadership/ >Perhaps it is fair to ask "What benefit" as well. >Corpocracy. You gotta love it. You're really beating around the bush, trying to imply there's something shady going…

This is not a conspiracy. This is just corporations acting in their best interest. Exactly the same as MicroSoft acted in their best interest as described here: https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor... . If that is confusing here is link to the Friedman Doctrine that explains it. https://en.wikipedia.org/wiki/Friedman_doctrine When we see a technology that appears beneficial and is not adopted,…

>If that is confusing here is link to the Friedman Doctrine that explains it. https://en.wikipedia.org/wiki/Friedman_doctrine

>When we see a technology that appears beneficial and is not adopted, I think it is fair to wonder why that is.

>...

>Perhaps a good question is what benefits might those corporations gain from their actions. Would Google and Apple benefit from broad adoption of Fido keys or would it somehow lessen their profits? I don't know the answer, but I know the question.

Again, I don't see any cogent arguments here aside from a vague anti-corporations sentiment along the lines of "corporations are greedy so they must be trying to oppress us at every opportunity". You mention "I think it is fair to wonder why that is", but you haven't articulate how hobbling u2f/fido/webauthn benefits the tech giants, when security is a huge pain point for them (both for their employees and their customers), and therefore they presumably benefit from it being adopted.

>- over several years I saw articles on HN that supposedly promoted Fido, but almost always they talked about Yubikeys. This continues.

Is there any evidence this was perpetuated by the fido alliance and/or their sponsors? Should we think there's a conspiracy by github because people confuse git with github?

>- Solokeys built an open source Fido key. They were priced very low compared to Yubikeys, but functioned just as well. You could buy them on Amazon at one point (and I did)

>- the Fido Alliance Accreditation fees https://fidoalliance.org/certification/authenticator-certifi...

What is this supposed to be evidence of? If anything this disproves your point that there can be competitors to yubikey.

Re: Hardware Touch, Stronger SSH

#45

Post by 8n4vidtmkvmk »

DetectDefect wrote: post #41
solatic wrote: post #34

Earlier quoted context omitted.

How do you prevent malware running on the pwned laptop from asking for an ephemeral cert to be issued? How do you know a human being is in the loop? Usually ephemeral sessions are up to 15 minutes (also to deal with misaligned clocks and unhappy users) - plenty of time for malware to ship the cert back to a command-and-control server. This is the key advantage of hardware keys, the fact that the physical press is req…

> How do you prevent malware running on the pwned laptop from asking for an ephemeral cert to be issued? If you have malware capable of code execution, restricting the ability to issue one command is not going to be a meaningful control, especially with something like a physical touch which most users are just conditioned to accept, or can be trivially phished into accepting. > plenty of time for malware to ship the…

I'd be fished in a heartbeat. I have to tap my key like 10 times every morning and then several times more throughout the day due to random logouts. Could be my IDE, a broken SSH connection or internal site that randomly decides to request it again and of course the popup gives no indication to where the request came from. It's ridiculous.

I think things would be more secure with fewer prompts because i wouldn't be conditioned to just tap every time it pops up.

Re: Hardware Touch, Stronger SSH

#47

Post by baobun »

ComputerGuru wrote: post #36
simon04 wrote: post #7

Using a Token2 based id_ed25519_sk_rk key, I found very helpful to configure a different `pushurl` in `.git/config`. This allows to pull via HTTPS w/o a hardware touch. [remote "origin"] url = https://github.com/freeCodeCamp/devdocs.git pushurl = git@github.com:freeCodeCamp/devdocs.git

GitHub dropped http authentication so this only works for public repos (not that the UX or security of http auth for git is nice). Can git be configured to use different keys for push and pull? (You can obviously use different upstreams, but thats not as elegant.) Most git servers let you specify read vs read-write privileges (aka “deployment keys”) so you could use one key to pull updates that doesn’t need touch and…

You configure separate entries in your ssh conf.

    Host gh-auth
      Hostname github.com
      Identityfile blah
      User git
pushurl = gh-auth:freeCodeCamp/devdocs.git

Re: Hardware Touch, Stronger SSH

#48

Post by estimator7292 »

gruez wrote: post #44
talkingtab wrote: post #42

Earlier quoted context omitted.

This is not a conspiracy. This is just corporations acting in their best interest. Exactly the same as MicroSoft acted in their best interest as described here: https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor... . If that is confusing here is link to the Friedman Doctrine that explains it. https://en.wikipedia.org/wiki/Friedman_doctrine When we see a technology that appears beneficial and is not adopted,…

>If that is confusing here is link to the Friedman Doctrine that explains it. https://en.wikipedia.org/wiki/Friedman_doctrine >When we see a technology that appears beneficial and is not adopted, I think it is fair to wonder why that is. >... >Perhaps a good question is what benefits might those corporations gain from their actions. Would Google and Apple benefit from broad adoption of Fido keys or would it somehow l…

It's an observation, not an argument.

Re: Hardware Touch, Stronger SSH

#49

Post by btreecat »

Shameless link to my own blog where I use a yubikey to store my SSH private key, a long with some advice for use in macos and Linux.

https://stephentanner.com/ssh-yubikey.html

Hopefully someone finds it useful.

The biggest issue I ran into was when folks wrote some tools that rely on ssh sock auth to automate connection to remote boxes. Not fun if you have to tap for every box.

Re: Hardware Touch, Stronger SSH

#50

Post by Arrowmaster »

ComputerGuru wrote: post #36
simon04 wrote: post #7

Using a Token2 based id_ed25519_sk_rk key, I found very helpful to configure a different `pushurl` in `.git/config`. This allows to pull via HTTPS w/o a hardware touch. [remote "origin"] url = https://github.com/freeCodeCamp/devdocs.git pushurl = git@github.com:freeCodeCamp/devdocs.git

GitHub dropped http authentication so this only works for public repos (not that the UX or security of http auth for git is nice). Can git be configured to use different keys for push and pull? (You can obviously use different upstreams, but thats not as elegant.) Most git servers let you specify read vs read-write privileges (aka “deployment keys”) so you could use one key to pull updates that doesn’t need touch and…

GitHub did not drop http auth. They prefer you use http instead of ssh.

What they dropped was auth using your account name and password. You need to use a token as your password or use an extra tool like their cli client to setup auth (but it sucks if you have multiple accounts).

Post reply on HN