Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Store an SSH Key on a Yubikey

xeiaso.net

Post reply on HN
Print view View original

71–80 of 154 posts

Re: How to Store an SSH Key on a Yubikey

#71

Post by tjoff »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

I haven't kept track of these, but are there no solutions to have a master key that one can create any number of keys from? And where that would not require one to update all hundred services using it.

Re: How to Store an SSH Key on a Yubikey

#73

Post by Sharparam »

ikornaselur wrote: post #32
moontear wrote: post #13

OT: what kind of date format is used in the article? It says „M05 27 2022“ and I have not seen that before. Does M05 mean May-05, so basically saying may-may?

I guess it's to clear the confusion of, for example, what date would "04 07 2022" be, is that 4th of July or April 7th? "M05 27 2022" seems to indicate that it's in fact MM DD YYYY not DD MM YYYY

If only there was some kind of international standard for date formatting we could use to get around that issue...

Re: How to Store an SSH Key on a Yubikey

#75

Post by mschuster91 »

yakak wrote: post #36
BoppreH wrote: post #22

Earlier quoted context omitted.

That's a very good question and in my opinion the biggest flaw with almost all new 2FA/passwordless systems. The "best practice" is to get a second yubikey or store recovery codes on paper, but that requires keeping them close to you because you'll need to update your backup on every new signup. That makes these systems entirely useless at protecting against house fires, signups while away from home, or simply servic…

I think people start with trying to do the best practice too early. Just using one key as your primary authentication adds a lot of security as other authentication methods aren't as routinely exposed. That's enough to get started and makes it easier to think about backups when one is ready for multiple keys.

> Just using one key as your primary authentication adds a lot of security

Yeah, and look just how often people lose or wash their phones or their keys, or how easy it is to break off a Yubikey that is on a keychain (e.g. when a cat pulls on it). Then you are usually royally screwed.

Re: How to Store an SSH Key on a Yubikey

#76

Post by smartbit »

stingraycharles wrote: post #6
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

As someone who uses Yubikey for about 5 years for SSH, GPG and O2F, an extra key is indeed the solution I use. Effectively it means all integrations must support multiple keys, and you’ll have to register both. Of course, this doesn’t work everywhere, such as AWS. In those cases, I typically use my “main” key. I’d argue that the key breaking due to wear or being lost is less of a risk than human error: just last week…

Which password manager do you use that supports Yubikey?

Re: How to Store an SSH Key on a Yubikey

#77

Post by xena »

Sharparam wrote: post #73
ikornaselur wrote: post #32

Earlier quoted context omitted.

I guess it's to clear the confusion of, for example, what date would "04 07 2022" be, is that 4th of July or April 7th? "M05 27 2022" seems to indicate that it's in fact MM DD YYYY not DD MM YYYY

If only there was some kind of international standard for date formatting we could use to get around that issue...

Owner of the blog here. I use the same date format on my website as I do on my phone: https://twitter.com/theprincessxena/status/15312403676008529...

Re: How to Store an SSH Key on a Yubikey

#78

Post by lalopalota »

BoppreH wrote: post #22
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

That's a very good question and in my opinion the biggest flaw with almost all new 2FA/passwordless systems. The "best practice" is to get a second yubikey or store recovery codes on paper, but that requires keeping them close to you because you'll need to update your backup on every new signup. That makes these systems entirely useless at protecting against house fires, signups while away from home, or simply servic…

For signups away from home, use the key you have then add the second when you get home.

Re: How to Store an SSH Key on a Yubikey

#79

Post by 5e92cb50239222b »

smartbit wrote: post #76
stingraycharles wrote: post #6

Earlier quoted context omitted.

As someone who uses Yubikey for about 5 years for SSH, GPG and O2F, an extra key is indeed the solution I use. Effectively it means all integrations must support multiple keys, and you’ll have to register both. Of course, this doesn’t work everywhere, such as AWS. In those cases, I typically use my “main” key. I’d argue that the key breaking due to wear or being lost is less of a risk than human error: just last week…

Which password manager do you use that supports Yubikey?

https://keepassxc.org

Re: How to Store an SSH Key on a Yubikey

#80

Post by lalopalota »

smartbit wrote: post #76
stingraycharles wrote: post #6

Earlier quoted context omitted.

As someone who uses Yubikey for about 5 years for SSH, GPG and O2F, an extra key is indeed the solution I use. Effectively it means all integrations must support multiple keys, and you’ll have to register both. Of course, this doesn’t work everywhere, such as AWS. In those cases, I typically use my “main” key. I’d argue that the key breaking due to wear or being lost is less of a risk than human error: just last week…

Which password manager do you use that supports Yubikey?

Bitwarden's paid plan supports yubikey.
Post reply on HN