Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Yubikey

debugging.works

Post reply on HN
Print view View original

61–70 of 186 posts

Re: How to Yubikey

#61

Post by agotterer »

nextlevelwizard wrote: post #12

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

I’ve carried a USB-A Yubikey in my pocket for 7 years and it’s never broke. I also keep one time login passwords encrypted and available in the cloud in the event I lose the key.

Re: How to Yubikey

#62

Post by TacticalCoder »

sam0x17 wrote: post #55

Other than Google Titan and Yubikey, are those really the only two players? I find it concerning that there is this whole ecosystem built around security keys, but only two companies making them. That said I currently use yubikeys for all my stuff, it just occurred to me its odd there isn't a bunch of companies making these :/

A friend of mine and all his colleagues are using OnlyKey (pricey). I use a Ledger Nano S for U2F/webauthn. These two are requiring a PIN to register/auth.

Re: How to Yubikey

#63

Post by lxgr »

joshvm wrote: post #13
nextlevelwizard wrote: post #12

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

You can also use the cheap ones, they work just as well for consumer purposes: https://www.yubico.com/ch/product/security-key-nfc-by-yubico... The only irritating bit is when you don't have USB-A (there is no A+C stick). But with NFC at least you can use your phone. I've yet to find a place (in my life anyway) where FIDO isn't accepted. Secures the main things like Google, Namecheap, etc.

That's one reason why I prefer USB-A security keys (it's just more ubiquitous at this point, and A-to-C adapters are readily available, while the reverse is out of USB spec).

The other is that USB-A has all moving parts in the socket (vs. in the cable-side plug), which presumably makes a USB-A key more reliable.

I've had USB-C keys break on me mechanically, so having an A-to-C adapter with moving parts on both sides seems like the best of both worlds (durable security key, durable device-side port, easily replaceable adapter).

Re: How to Yubikey

#64

Post by lxgr »

twawaaay wrote: post #54

Missing from all this: a dedicated machine running Linux to set everything up. I have an old beat up Thinkpad that I use exclusively for critical stuff that would really hurt me if somebody hacked. You can have one for less than the price of Yubikey so there really isn't much excuse.

What's the benefit of that?

The entire point of using a security key is that its security model can survive a point in time compromise of the device you are connecting it to, i.e. a compromise only persists as long as a (hopefully short-lived) session. But if a single session compromise is unacceptable to you, by the same token a security key can't protect you against that.

The only instance where a "more secure" computer might be necessary that I can think of is using a GPG smartcard (which the Yubikey supports) and importing a software key to that, as opposed to generating the key on the smartcard itself.

Re: How to Yubikey

#65

Post by lxgr »

agotterer wrote: post #61
nextlevelwizard wrote: post #12

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

I’ve carried a USB-A Yubikey in my pocket for 7 years and it’s never broke. I also keep one time login passwords encrypted and available in the cloud in the event I lose the key.

I've had one USB-C key break on me in the past, and my replacement is already showing signs of wear. Fortunately it's not my only way to get back into my accounts if it breaks.

My (sample size 2) theory is that USB-C isn't the best connector for a security key, since it intentionally moves the wear-prone part (i.e. the dust-collecting and mechanical spring involving side) from the port to the cable.

USB-A is completely solid state, and most security keys use the "flat" variant of the plug that further reduces the chance of mechanical damage and/or collecting dust.

Re: How to Yubikey

#66

Post by lxgr »

sheerun wrote: post #21

I really would like to use it, but without ability to backup it, I don't wanna. I've read some time ago Yubikey of some other company showed initial spec, but I never heard any followup, I don't remember the link. For now I'm using TOTP but it's a chore. Salesforce Authenticator has nice idea with custom push-based protocol, but it's not running on dedicated hardware. I think ESP32 S3 has hardware potential to act as…

> ESP32 S3 has hardware potential to act as security

You'll probably want a tamper-proof MCU instead (i.e. the type used on payment smart cards and SIMs), if physical access is a concern to you at all.

> without ability to backup it

Your backup can be another security key. If you are concerned about design flaws (of the reliability/durability kind, not security), you can get FIDO-certified keys from many vendors other than Yubico these days.

Re: How to Yubikey

#68

Post by fullstop »

lxgr wrote: post #65
agotterer wrote: post #61

Earlier quoted context omitted.

I’ve carried a USB-A Yubikey in my pocket for 7 years and it’s never broke. I also keep one time login passwords encrypted and available in the cloud in the event I lose the key.

I've had one USB-C key break on me in the past, and my replacement is already showing signs of wear. Fortunately it's not my only way to get back into my accounts if it breaks. My (sample size 2) theory is that USB-C isn't the best connector for a security key, since it intentionally moves the wear-prone part (i.e. the dust-collecting and mechanical spring involving side) from the port to the cable. USB-A is complete…

You can buy dust covers for USB-C male connectors.

Re: How to Yubikey

#69

Post by lxgr »

fullstop wrote: post #68
lxgr wrote: post #65

Earlier quoted context omitted.

I've had one USB-C key break on me in the past, and my replacement is already showing signs of wear. Fortunately it's not my only way to get back into my accounts if it breaks. My (sample size 2) theory is that USB-C isn't the best connector for a security key, since it intentionally moves the wear-prone part (i.e. the dust-collecting and mechanical spring involving side) from the port to the cable. USB-A is complete…

You can buy dust covers for USB-C male connectors.

Sure, but that doesn't help against the springs mechanically wearing out, or mechanical damage bending the hollow part of the USB-C connector.

Looking at all of my USB-C keys, most of them get visibly bent inwards after a couple of years of carrying them in a pocket on a keychain with other keys.

It's hard to imagine a USB-A key breaking in the same way. The only thing that could conceivably break it is the PCB itself snapping, or possibly static electricity (but I don't know how much better USB-C keys would fare in that regard).

So given that I can buy 2-3 A-to-C adapters for the price difference between a USB-A and a USB-C key, why take the additional risk?

Re: How to Yubikey

#70

Post by zikduruqe »

ojkelly wrote: post #38
manmal wrote: post #31

Earlier quoted context omitted.

Safari seems to have its own implementation of a virtual security key also. Before I plugged in my Yubico recently, Safari asked me for my fingerprint as a fallback.

That’s part of WebAuthN[0]. Some services like AWS will not allow virtual U2F keys to be registered, but most places do. [0] https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...

It works for Safari.

For AWS, I use Firefox and a FIDO key, and have a backup MFA as Safari using U2F.

Post reply on HN