Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using a Yubikey as a touchless, magic unlock key for Linux

kliu.io

Post reply on HN
Print view View original

61–70 of 74 posts

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#61

Post by jfb »

flurdy wrote: post #12

Some time there was a similar tool that locked the computer via bluetooth if you walked away from the desk with your phone. It didn't unlock it which is fine, but it seems a better way to lock a computer if you forget rather than a timed screensaver after x minutes which leaves the computer vulnerable until then. (Mostly just from colleagues changing your wallpaper, or autocorrect...)

There used to be a Mac app called "Bluephone Elite", IIRC, that could do this for a very specific group of phones. It worked with my Sony Ericcson thing BITD.

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#62

Post by new_realist »

saghm wrote: post #48
new_realist wrote: post #45

So anyone can take my Yubikey and use it to gain access to my computer without so much as a PIN? Is that a good idea?

To be fair, that's also how cars and houses tend to work

I prefer progress in the forward direction.

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#64

Post by stingraycharles »

ashtonkem wrote: post #41

A permanently attached Yubikey is not worse than a password alone, and is still superior to SMS 2FA. It still requires that an attacker know both your password and have physical possession of your machine. For the vast majority of users, this is sufficient protection from the threats that they face. The chance that someone both knows your password and is close enough to steal your yubikey is incredibly unlikely. If y…

Yeah I have this setup for quite a few years by now, and occasionally I question whether this practice makes sense.

What does make it incredibly dangerous is that it also applies for eg “sudo”: if you don’t have any additional protection, it effectively means that any exploit in any app can be immediately extended to a local privilege escalation, as there is no additional protection in place.

In other words, be careful what you wish for. :)

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#65

Post by mindfulhack »

deadbunny wrote: post #50
kayodelycaon wrote: post #47

Earlier quoted context omitted.

The major one is deep integration of applications with the OS. One example is any keyboard shortcut in any application can be remapped at the OS level. Dictation and services available almost everywhere text can be entered. Any text in almost any dialogue is selectable. Application dialogs like open and print are standardized. The print dialog is incrediably rich with functionality, in every application. This extends…

Don't worry in not one of the zealots that'll try and convince you that Linux has a suitable replacement for something then recommend some this that does t match up (see you MS Office vs. Libre Office for example). Just genuinely interested to know where Linux is lacking for some people (and thus something I might be missing). While I'm definitely an open source advocate I too am a pragmatist and will happily use clo…

I'm trying to move my daily driver from macOS to Linux.

(Why? Privacy, more control over how technology interacts with me, and because at a really deep level, I know this is the expression of my authentic self. I don't like to 'blindly accept' things from others without questioning it, and I like to create. I also love to learn. All this is balanced with the desire to just sit back and enjoy a smooth experience like anyone else, half the time.)

I'm slowly researching and trying out open-source alternatives to my daily must-have apps like Notes.app, which is a great example of, so far, why this is so challenging. But I'm trying to adjust and see what can be good enough. (Web apps is not an acceptable solution, due to basic privacy expectations.)

It's reasonable to expect I have to adjust my methods somewhat, but I do need such alternative workflows to be as feature-filled and performant as what I currently use.

Like most, work requirements like Office (and Acrobat) are my greatest challenge. Perhaps macOS on KVM for near-native performance with Office + Adobe for Mac in it will be good enough?

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#66

Post by jpalomaki »

flurdy wrote: post #12

Some time there was a similar tool that locked the computer via bluetooth if you walked away from the desk with your phone. It didn't unlock it which is fine, but it seems a better way to lock a computer if you forget rather than a timed screensaver after x minutes which leaves the computer vulnerable until then. (Mostly just from colleagues changing your wallpaper, or autocorrect...)

Windows 10 has this feature [1]. Would be more useful if you could tune the required signal strenght.

[1] https://support.microsoft.com/en-us/help/4028111/windows-loc...

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#67

Post by SahAssar »

tialaramex wrote: post #51
SahAssar wrote: post #36

> Yubikeys are great for security, but not when you leave them in your computer unattended. At that point, anyone can take the key and use it for 2-factor authentication/SSH/GPG signing, so it’s not much better than just using a normal password. Even after the edit at the top regarding PIN it still seems to not get the main point of a U2F token: It's physical. It's incredibly hard to extract secrets from it. It's loc…

In this context it's probably better to think about them as FIDO/ CTAP tokens rather than as U2F (which is obsoleted by WebAuthn and focused on the Web) or, as the author does, just narrow it explicitly to Yubikeys and not the wider menagerie of similar products. Yubico's own Security Key implements FIDO2 (and so could also be used for U2F) but won't work for the author's approach. Anyway, the main thing I wanted to…

Is any of that a contradiction of what I said or are you providing context?

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#68

Post by tialaramex »

SahAssar wrote: post #67
tialaramex wrote: post #51

Earlier quoted context omitted.

In this context it's probably better to think about them as FIDO/ CTAP tokens rather than as U2F (which is obsoleted by WebAuthn and focused on the Web) or, as the author does, just narrow it explicitly to Yubikeys and not the wider menagerie of similar products. Yubico's own Security Key implements FIDO2 (and so could also be used for U2F) but won't work for the author's approach. Anyway, the main thing I wanted to…

Is any of that a contradiction of what I said or are you providing context?

On re-examination of what you wrote I think I misinterpreted this sentence:

"everyone who have a physical key I keep within a reasonable distance from me that is incredibly hard to copy and has my password"

I took (hard to copy and has my password) to be properties you were giving the physical key, but in fact I see the correct interpretation was that "and has my password" is an adjunct to the properties of this hypothetical attacker who now needs to steal the key.

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#69

Post by SahAssar »

tialaramex wrote: post #68
SahAssar wrote: post #67

Earlier quoted context omitted.

Is any of that a contradiction of what I said or are you providing context?

On re-examination of what you wrote I think I misinterpreted this sentence: "everyone who have a physical key I keep within a reasonable distance from me that is incredibly hard to copy and has my password" I took (hard to copy and has my password) to be properties you were giving the physical key, but in fact I see the correct interpretation was that "and has my password" is an adjunct to the properties of this hypo…

Yeah, I meant "(has the key) and (has my password)", not "has my key which has my password". The reply makes a lot more sense now, thanks for the clarification! I'll try to be more unambiguous.

Re: Using a Yubikey as a touchless, magic unlock key for Linux

#70

Post by deadbunny »

mindfulhack wrote: post #65
deadbunny wrote: post #50

Earlier quoted context omitted.

Don't worry in not one of the zealots that'll try and convince you that Linux has a suitable replacement for something then recommend some this that does t match up (see you MS Office vs. Libre Office for example). Just genuinely interested to know where Linux is lacking for some people (and thus something I might be missing). While I'm definitely an open source advocate I too am a pragmatist and will happily use clo…

I'm trying to move my daily driver from macOS to Linux. (Why? Privacy, more control over how technology interacts with me, and because at a really deep level, I know this is the expression of my authentic self. I don't like to 'blindly accept' things from others without questioning it, and I like to create. I also love to learn. All this is balanced with the desire to just sit back and enjoy a smooth experience like…

Personally I use NextCLoud for things like Notes[1], while it is a web app it is self hosted. Obviously this means you then need to run NextCloud yourself which is an entirely different problem.
Post reply on HN