Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys • Hacker News Board

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#51

Post by Boulth » Mon, May 11, 2020, 4:15 PM UTC

jopsen wrote: post #44

Boulth wrote: post #30

Earlier quoted context omitted.

> The biggest pain is that I have to reconfigure when I switch yubikey. This is planned to be fixed in GnuPG 2.3.

Wow, how? Currently I understand that gpg records a card identifier. And my card doesn't have the same id. I suppose it'll be a long time before this hits stable distros anyways. But nice to see improvements :)

It was some time when I read the explanation on how do they want to approach this but I guess the card identifier will no longer be needed (or all card ids will be stored).

If you want to check it yourself https://dev.gnupg.org/T4695

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#52

Post by cr7pt0 » Fri, May 15, 2020, 3:29 PM UTC

microtonal wrote: post #6

fidelramos wrote: post #4

I want to mention a Yubikey alternative that runs on open-source firmware and software: OnlyKey [1] It has an onlykey-agent that works as an SSH agent [2]. It doesn't work as a GPG agent yet though, they are reportedly working on it. [1] https://onlykey.io/ [2] https://docs.crp.to/onlykey-agent.html

You may want to read the recent discussion on HN about OnlyKey before using one: https://news.ycombinator.com/item?id=21884184

Make sure you read down on this thread https://news.ycombinator.com/item?id=21884184 there is a lot of misinformation in the top posts that are completely debunked if you read down. Like someone said OnlyKey is an Arduino which its not and that it doesn't have hardware security which it does. You can find full list of hardware security features here - https://docs.crp.to/security.html

Re: Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys

#53

Post by krabelize » Thu, May 21, 2020, 3:05 PM UTC

veeti wrote: post #28

stavros wrote: post #14

I have been trying to use Yubikey for SSH over the years, and everything has been a huge hassle that just didn't work well enough. Everything, that is, until SSH 8.2 came out. Using a Yubikey (or any other U2F-compatible key, which is a lot of them) is a breeze: Run `ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk` to generate a key from your Yubikey and you're done. You can even use Resident Keys mode (if your key supp…

> The downside is that both sides have to be running SSH 8.2+. This is the problem. I was really excited for FIDO SSH keys, but LTS server distributions don't support it so it's going to take years for broad adoption.

Yes - but it works smoothly: https://cryptsus.com/blog/how-to-configure-openssh-with-yubi...