Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using a Yubikey as a touchless, magic unlock key for Linux

kliu.io

Post reply on HN
Print view View original

51–60 of 74 posts

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#51

Post by tialaramex »

SahAssar wrote: post #36

> Yubikeys are great for security, but not when you leave them in your computer unattended. At that point, anyone can take the key and use it for 2-factor authentication/SSH/GPG signing, so it’s not much better than just using a normal password. Even after the edit at the top regarding PIN it still seems to not get the main point of a U2F token: It's physical. It's incredibly hard to extract secrets from it. It's loc…

In this context it's probably better to think about them as FIDO/ CTAP tokens rather than as U2F (which is obsoleted by WebAuthn and focused on the Web) or, as the author does, just narrow it explicitly to Yubikeys and not the wider menagerie of similar products. Yubico's own Security Key implements FIDO2 (and so could also be used for U2F) but won't work for the author's approach.

Anyway, the main thing I wanted to mention is that the use of public key encryption means this is quite different from the device having "my password". Even in the on-device ("resident credential") scenarios the authenticator doesn't have a password which is a shared secret, it actually has a private key which it won't divulge - much better.

Implementation errors by a web site can leak your password, which because it's a shared secret can then be used by adversaries to log in. It's impossible to be sure a site didn't get this wrong, even if you're confident they are competent and well meaning.

In contrast the WebAuthn (and U2F) design doesn't give sites enough information to impersonate you even if they wanted to, only to authenticate you. This is a familiar pattern from public key cryptography, receiving the certificate for news.ycombinator.com allows me to verify this is news.ycombinator.com but not impersonate them. Likewise, when you enroll a FIDO authenticator to use Facebook, Facebook doesn't learn how to impersonate you, even on Facebook, only a way to verify that you still have that authenticator. [And the design is even more careful, it uses completely independent credentials for each site, so when Microsoft bought GitHub they actually could not merge the FIDO-based authentication between GitHub and Microsoft properties, even if they thought that was a good idea it's deliberately impossible. ]

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#52

Post by tialaramex »

aborsy wrote: post #25
GekkePrutser wrote: post #19

Sounds good, but I'd really want to use a PIN with that. Otherwise anyone can take my key and walk up to the computer and unlock it. I wonder if there is something like pam_piv? I use PIV already for Mac & Windows... Suppose I should look for it myself :)

You need a pin for GPG. Note that, that would protect only the gpg keys. Don’t forget to set a password also for the YubiKey Authenticator app. Otherwise I believe anyone who has your key would see the websites with which you have Fido U2F and use it.

> Don’t forget to set a password also for the YubiKey Authenticator app. Otherwise I believe anyone who has your key would see the websites with which you have Fido U2F and use it.

From what I can see YubiKey Authenticator is a TOTP authenticator. So that's completely orthogonal to U2F (and less safe, although more familiar to users who have things like Google Authenticator)

With U2F non-resident credentials don't leave any trace. If somebody has stolen a working authenticator they'd need to guess sites at which its non-resident credentials would be valid and then try it.

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#53

Post by StavrosK »

trishankdatadog wrote: post #40

BTW, here is a handy way to quickly generate GPG keys (and set up git commit signing and SSH key derivation) on Yubikey: https://github.com/DataDog/yubikey

If you only want to do SSH, that way is a huge hassle, way too much to do on machines you don't own/are using casually. If you can use newer SSH versions, they support FIDO2 natively:

https://www.stavros.io/posts/u2f-fido2-with-ssh/

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#54

Post by allset_ »

ashtonkem wrote: post #42
SahAssar wrote: post #39

Earlier quoted context omitted.

If you are talking about a U2F usb stick I agree with you (I put "incredibly hard" instead of "impossible" there so that I don't get counterarguments with people reading memory with electron microscopes or similar). If you are talking plain USB mass storage for keys I disagree.

For most of us, the inability for the key to be duplicated remotely is the primary design criteria, as most of us need to defend against low to moderate remote attacks (which is exactly SMS 2FA is bad). You have to be an incredibly high value target before "my opponents are willing to send people to try and steal my 2FA token from my person and clone it" is a probable risk. At that point you better be using all kinds…

USB mass storage based authentication also does not protect against malware stealing the keys. A YubiKey (or similar token) performs all of the cryptographic operations in a separate environment that malware cannot access.

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#55

Post by Legogris »

ashtonkem wrote: post #41

A permanently attached Yubikey is not worse than a password alone, and is still superior to SMS 2FA. It still requires that an attacker know both your password and have physical possession of your machine. For the vast majority of users, this is sufficient protection from the threats that they face. The chance that someone both knows your password and is close enough to steal your yubikey is incredibly unlikely. If y…

> liable to get personally targeted for nation state level attacks

Groups also potentially at risk:

* Targets for industrial espionage (you might not be interesting but your employer is)

* Those believed to hold larger amounts of cryptocurrency

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#56

Post by m463 »

SahAssar wrote: post #39
Spivak wrote: post #37

Earlier quoted context omitted.

Honestly the threat of someone cloning the key is so minor that a USB stick is probably enough. If someone goes through the effort to make fake a USB stick with the right hardware ids then I've got way bigger problems.

If you are talking about a U2F usb stick I agree with you (I put "incredibly hard" instead of "impossible" there so that I don't get counterarguments with people reading memory with electron microscopes or similar). If you are talking plain USB mass storage for keys I disagree.

never use absolutes on the internet.

(it's kind of funny how you can make a seemingly airtight argument about something common-sense and non-controversial and have some weird imposs.. improbable corner case unravel everything)

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#57

Post by ashtonkem »

allset_ wrote: post #54
ashtonkem wrote: post #42

Earlier quoted context omitted.

For most of us, the inability for the key to be duplicated remotely is the primary design criteria, as most of us need to defend against low to moderate remote attacks (which is exactly SMS 2FA is bad). You have to be an incredibly high value target before "my opponents are willing to send people to try and steal my 2FA token from my person and clone it" is a probable risk. At that point you better be using all kinds…

USB mass storage based authentication also does not protect against malware stealing the keys. A YubiKey (or similar token) performs all of the cryptographic operations in a separate environment that malware cannot access.

Yes, that would be a “remote copy” since it doesn’t require physical access to the u2f token.

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#58

Post by rossjudson »

Seems like a bad idea. Requiring a touch means it's much harder to trigger the key through software alone -- or maybe impossible. So someone has to actually be present at the machine. This is particularly important when, for whatever reason, the machine you can actually put your hands on is actually a gateway to other machines. You can ssh tunnel all you want, but somebody still has to physically touch the key for it to authenticate. Naturally, that only works if you authenticate at each level, and if you do not trust other levels.

The way we use them at Google, the keys are associated to particular machines and human accounts. You can't just remove a key from one machine and stick it into something else. It is the combination of the machine and the key that is enabled. A key can be deregistered/wiped, and assigned to a different machine...but you need to be properly logged in to make that happen. In the context of a corporation that is relatively straightforward, but perhaps for personal use it is less so. Actually, without the right infrastructure in place, it's quite likely to be a lot more complicated.

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#59

Post by Legogris »

StavrosK wrote: post #53
trishankdatadog wrote: post #40

BTW, here is a handy way to quickly generate GPG keys (and set up git commit signing and SSH key derivation) on Yubikey: https://github.com/DataDog/yubikey

If you only want to do SSH, that way is a huge hassle, way too much to do on machines you don't own/are using casually. If you can use newer SSH versions, they support FIDO2 natively: https://www.stavros.io/posts/u2f-fido2-with-ssh/

I don't think many people use GPG keys for SSH only (:

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#60

Post by trishankdatadog »

StavrosK wrote: post #53
trishankdatadog wrote: post #40

BTW, here is a handy way to quickly generate GPG keys (and set up git commit signing and SSH key derivation) on Yubikey: https://github.com/DataDog/yubikey

If you only want to do SSH, that way is a huge hassle, way too much to do on machines you don't own/are using casually. If you can use newer SSH versions, they support FIDO2 natively: https://www.stavros.io/posts/u2f-fido2-with-ssh/

Sure, but most SSH servers probably don't support FIDO2 yet (GitHub didn't the last time I checked).

Also, please sign your git commits.

Post reply on HN