Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting the most out of YubiKeys for your business

blog.congruentlabs.co

Post reply on HN
Print view View original

51–60 of 77 posts

Re: Getting the most out of YubiKeys for your business

#51

Post by tomjen3 »

tialaramex wrote: post #46
Exmoor wrote: post #23

Earlier quoted context omitted.

That makes sense, and initially that is how I treated it, but essentially everyone I work with keeps theirs plugged in to their laptops 24/7. In fact, the keys we get as backups/replacements are the low profile ones designed to be plugged in and not removed without significant difficulty.

The effect this has is to make the laptop a "Something you have" factor. This works fine so long as the business is strict about ensuring people treat laptops appropriately and report losses quickly. e.g. my last big corporate employer would sometimes randomly take any laptops that had not been properly physically secured during a meeting or over lunch. You'd come back and somebody groans "Oh no, we were only gone a…

The only way to lock laptops to things I have seen have been Kensington slots, and those are literally security theater. You can cut them straight through their cables with a simple plier and zero effort, in one motion.

Re: Getting the most out of YubiKeys for your business

#52

Post by elevation »

akerl_ wrote: post #48
0xCMP wrote: post #47

Something rarely mentioned with SSH, but which there have been a few recent articles on HN about, are SSH certificates and the fact that you can use the PIV of a yubikey to do certificate management. e.g. You can create a certificate which you load the public key of in to your servers (using initial access or baked in to some image) which the private key is loaded in the PIV of the YubiKey. Someone can then generate…

It’s worth noting that for “SSH certificates”, the leaf certs are not x509-based, and that you can’t put a CA-signed SSH user key onto a yubikey. When yubikeys are used for SSH auth (either in GPG or PIV mode), they’re using the raw private key (either via GPG-agent or opensc, generally). The SSH client/server doesn’t get context about the identity, its trust relationships, etc. This limits usage to trusting individu…

What token hardware does support x509 certs (and thus compatible with an SSH CA?)

Re: Getting the most out of YubiKeys for your business

#53

Post by fullstop »

deadbunny wrote: post #36
jwr wrote: post #34

YubiKeys are absolutely fantastic, and under-rated, too. I used this guide: https://github.com/drduh/YubiKey-Guide to set up my YubiKeys with GPG keys that are also used as SSH keys. This gives me, in a single setup: * secure 2FA for sites with WebAuthN * ability to encrypt backups and other information using GPG, with decryption only possible with a physical device * ability to securely log in via SSH to all my infr…

Same use case here. While setting up the yubikey with the gpgkeys is a long process it's totally worth it in my opinion.

I went through this as well, and it was a really fun task. Then I realized that I do not use GPG nearly as often as I thought I would.

I ordered some CDs online once in the late 90s from CDNow, and they let you email them credit card information in a PGP encrypted message. How times have changed, eh?

Re: Getting the most out of YubiKeys for your business

#54

Post by fullstop »

graton wrote: post #27
Exmoor wrote: post #13

I feel like I'm really missing something on why Yubikeys are such a popular form of 2FA. My previous employer utilized a phone app that would spawn a notification when you were trying to do something requiring a 2nd authentication factor. You had to either enter a 6 digit pin or use a fingerprint to authorize. My current employer utilizes Yubikey, and it just feels clunkier and less secure? I still have to have a pie…

Well that is kind of the the point of multi-factor authentication. * Something you know (your username/password). * Something you have. The Yubikey or other hardware token. If you lose your Yubikey, by itself it should not allow access to anything. I keep mine on my keyring with my keys, which I haven't lost yet.

I want to get some sort of retractable lead for mine. My keys are heavy-ish and sometimes it can be difficult to get the key in a usb port without tension.

Re: Getting the most out of YubiKeys for your business

#55

Post by count »

akerl_ wrote: post #48
0xCMP wrote: post #47

Something rarely mentioned with SSH, but which there have been a few recent articles on HN about, are SSH certificates and the fact that you can use the PIV of a yubikey to do certificate management. e.g. You can create a certificate which you load the public key of in to your servers (using initial access or baked in to some image) which the private key is loaded in the PIV of the YubiKey. Someone can then generate…

It’s worth noting that for “SSH certificates”, the leaf certs are not x509-based, and that you can’t put a CA-signed SSH user key onto a yubikey. When yubikeys are used for SSH auth (either in GPG or PIV mode), they’re using the raw private key (either via GPG-agent or opensc, generally). The SSH client/server doesn’t get context about the identity, its trust relationships, etc. This limits usage to trusting individu…

This seems to indicate you can: https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK...

('If an external key has been imported and a certificate already exists, skip step 2' - you can import a certificate signed by a CA, and OpenSSH allows you trust certs signed by a given CA.)

Am I missing something here where that doesn't work in this combo? Or are you referencing 'ssh keys' specifically, as opposed to 'certificates being used for ssh'?

Re: Getting the most out of YubiKeys for your business

#56

Post by fullstop »

tialaramex wrote: post #44
pricechild wrote: post #41

Earlier quoted context omitted.

I think the point was that most u2f implementations around don't just allow OTP as backups... they require you to set up OTP first before u2f can be enabled. It does make a bit of sense. Users can't be trusted not to lose their single token. But rarely is the option to enrol a second u2f key as backup permitted.

The only place I've used WebAuthn/ U2F that did not allow me to enrol multiple keys was AWS. I have two (or more) keys enrolled at Facebook, Google, GitHub, and for my government services. WebAuthn (which is the one that's actually a documented standard) not only goes out of its way to make multiple tokens practical it explicitly calls out the intent that you should allow users to enrol multiple tokens.

Google won't let you enroll with just one key. You need at least two.

Also, if you happen to have a Ledger for crypto crap, those support U2F as well. It's less convenient because you need to connect it to a PC, enter the PIN, and then open the U2F applet.

Re: Getting the most out of YubiKeys for your business

#58

Post by akerl_ »

elevation wrote: post #52
akerl_ wrote: post #48

Earlier quoted context omitted.

It’s worth noting that for “SSH certificates”, the leaf certs are not x509-based, and that you can’t put a CA-signed SSH user key onto a yubikey. When yubikeys are used for SSH auth (either in GPG or PIV mode), they’re using the raw private key (either via GPG-agent or opensc, generally). The SSH client/server doesn’t get context about the identity, its trust relationships, etc. This limits usage to trusting individu…

What token hardware does support x509 certs (and thus compatible with an SSH CA?)

The Yubikey supports x509 certs (this is the PIV app). And you can use them for SSH authentication via opensc or similar. But this just uses the RSA private key, not the cert.

SSH’s built-in CA support uses a certificate authority private key to sign regular SSH public keys. The resulting public key cert isn’t compatible, as far as I know, with any hardware keys.

Re: Getting the most out of YubiKeys for your business

#59

Post by smichel17 »

fullstop wrote: post #54
graton wrote: post #27

Earlier quoted context omitted.

Well that is kind of the the point of multi-factor authentication. * Something you know (your username/password). * Something you have. The Yubikey or other hardware token. If you lose your Yubikey, by itself it should not allow access to anything. I keep mine on my keyring with my keys, which I haven't lost yet.

I want to get some sort of retractable lead for mine. My keys are heavy-ish and sometimes it can be difficult to get the key in a usb port without tension.

When I had more keys on my keyring I used something like this https://www.amazon.com/Lucky-Line-Keychain-Nickel-Plated-707... (not this particular one, which is just the top result that looked similar). It worked pretty well for a single key, but if you want to use more than one it adds a lot of extra bulk so your keychain gets even bigger.

I also tried something like this https://www.amazon.com/Spider-Accessory-Split-Rings-Pack/dp/.... It worked pretty well for a few weeks, but then the central piece loosened up and the keys started falling off in my pocket; not recommended unless you can find one that's really sturdy.

Re: Getting the most out of YubiKeys for your business

#60

Post by akerl_ »

count wrote: post #55
akerl_ wrote: post #48

Earlier quoted context omitted.

It’s worth noting that for “SSH certificates”, the leaf certs are not x509-based, and that you can’t put a CA-signed SSH user key onto a yubikey. When yubikeys are used for SSH auth (either in GPG or PIV mode), they’re using the raw private key (either via GPG-agent or opensc, generally). The SSH client/server doesn’t get context about the identity, its trust relationships, etc. This limits usage to trusting individu…

This seems to indicate you can: https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK... ('If an external key has been imported and a certificate already exists, skip step 2' - you can import a certificate signed by a CA, and OpenSSH allows you trust certs signed by a given CA.) Am I missing something here where that doesn't work in this combo? Or are you referencing 'ssh keys' specifically, as opposed to 'cer…

That doc doesn’t use a CA at all.

Step 1 has you import an existing RSA private key or generate one on the device.

In step 2, you self-sign the certificate. As noted in the doc, “The only use for the x509 certificate is to satisfy the PIV/PKCS #11 lib”. You can skip this, per the note in step 1, if your key is already signed.

In future steps, when you’re SSHing with the pkcs11 library, it’s using the public/private components of that RSA key. The certificate (any certificate) has to exist because PKCS11 needs that to cleanly view the public key, but the actual cert metadata, including issuer, is fully unused. Importing a cert signed by a CA has no impact on the result.

On the OpenSSH side, their “CA” support does not create signed leaf x509 certificates. You trust a cert public key, and it signs an OpenSSH-specific representation of user/host public key. OpenSSH then has a special public key type for authenticating using that signed key. As such, PIV/PKCS11 keys, as far as I’m aware, cannot be used as part of OpenSSH’s “CA” support.

Post reply on HN