Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Yubikey

debugging.works

Post reply on HN
Print view View original

91–100 of 186 posts

Re: How to Yubikey

#91

Post by InCityDreams »

djha-skin wrote: post #79

It's pretty annoying having to touch my yubi key every single time. I find KeePassXC + TOTP much more user and disaster resilient. If I lose my yubikey, I'd better have a physical backup copy. If I lose my keypass device, my file is just up on Dropbox. I find the value proposition is outweighed by the risk of disaster for yubikey personally, and keepass doesn't make me touch it every time so it's much more convenient…

>If I lose my keypass device, my file is just up on Dropbox.

I've considered keeping my keepass file on the cloud...still wary.

Re: How to Yubikey

#92

Post by manmal »

zikduruqe wrote: post #70
ojkelly wrote: post #38

Earlier quoted context omitted.

That’s part of WebAuthN[0]. Some services like AWS will not allow virtual U2F keys to be registered, but most places do. [0] https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...

It works for Safari. For AWS, I use Firefox and a FIDO key, and have a backup MFA as Safari using U2F.

If Secure Enclave is as secure as Apple claims it to be, Safari‘s option might actually be the safest one. Of course you can’t use that on anything other than a Mac or iPhone, so in some situations you need another key.

Re: How to Yubikey

#93

Post by sowbug »

sedatk wrote: post #11
toastal wrote: post #5

Reminder: Yubico doesn't have a monopoly on security keys. Make sure your software/tutorials support the open-source alternatives like OnlyKey and NitroKey.

or SoloKey

Unfortunately SoloKey doesn't work as an OpenPGP smart card, which means it's not a real substitute for a Yubikey. I haven't had any luck with resident FIDO2, either.

The Solo team believes that other functionality such as PIV overlaps with GnuPG use cases, so that OpenPGP isn't a priority, and their work on that functionality appears to have stopped in 2021. That's too bad, because OpenPGP's network effects far outweigh its pure functionality, which means a technical substitute isn't a substitute.

https://github.com/solokeys/openpgp

Re: How to Yubikey

#94

Post by Mindless2112 »

beagle3 wrote: post #8
imiric wrote: post #6

Great, modern guide. Thanks! While I have a few Yubikeys in a drawer somewhere, for years I've preferred to use an actual smartcard to store my keys. Sure, it only offers a subset of the features of a USB key, but I've found that I really only need to sign, auth and decrypt data. All the other fancy things like OTP, FIDO, etc., either have alternatives (e.g. pass-otp), or are just not used often enough. I haven't bee…

Which card are you using?

If you're looking for a FIDO smartcard, I've been using this [1].

[1] https://shop.cryptnox.com/products/cryptnox-fido-2-card

Re: How to Yubikey

#95

Post by InCityDreams »

krisoft wrote: post #44
cookiengineer wrote: post #32

The attack surface of yubikey vs a laptop you carry around is interesting. Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. Anybody using USB locks? If you are focussing on FIDO for password management, I am assuming you are protected against HID emulating devices, like a rubberducky or teensy flashed with some malware installing HID emula…

> Nobody seems to reflect that if you physically steal the laptop, guess what, the usb key that's still in there was also stolen. Not in how I use it. I only connect my yubikey when I need it (rarely at that). > right? Right? Just generally don't do this. It comes of as unnecessarily aggressive. Instead you could say "Do use USB locks on your laptop, because ....". The "right? Right?" is not making your point more pe…

> Just generally don't do this. It comes of as unnecessarily aggressive. Instead you could say "Do use USB locks on your laptop, because ....". The "right? Right?" is not making your point more persuasive.

Pot, kettle situation?

Re: How to Yubikey

#96

Post by jrib »

ixwt wrote: post #86
nextlevelwizard wrote: post #12

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

If you setup a domain to use Cloudflare, and then sign up for their zero trust system, you can get a code to get up to 4 yuibkey's for $10 each.

Is this still the case?

I came across this blog post about a similar offer: https://blog.cloudflare.com/making-phishing-defense-seamless...

but it now states:

> UPDATE: This offer expired on January 3rd, 2023 at 8am PST.

Re: How to Yubikey

#97

Post by PaulWaldman »

atoav wrote: post #88
vifon wrote: post #50

> I don’t see any use case or security benefits by using the static password feature. Even if you enter a password manually and concatenate it with the password of the Yubikey, a keylogger still gets both parts (assumption: You don’t reuse passwords). If keylogger is what you're defending from, yes, it doesn't help. And in this scenario you've probably already lost. On the other hand, it makes a large portion of the…

Also: something you don't know is also something you cannot tell the person threatening you with the 5$ wrench¹ ¹: https://xkcd.com/538/

Aren't you always vulnerable in this scenario?

If you have your device in your possession, you also likely have your key in your possession in order to use your device.

Re: How to Yubikey

#98

Post by nyolfen »

toastal wrote: post #5

Reminder: Yubico doesn't have a monopoly on security keys. Make sure your software/tutorials support the open-source alternatives like OnlyKey and NitroKey.

do any other keys have feature sets on par with yubikeys? last i checked they were ahead by a mile, the others i looked at were just fido2 keys

Re: How to Yubikey

#99

Post by thesuitonym »

PaulWaldman wrote: post #97
atoav wrote: post #88

Earlier quoted context omitted.

Also: something you don't know is also something you cannot tell the person threatening you with the 5$ wrench¹ ¹: https://xkcd.com/538/

Aren't you always vulnerable in this scenario? If you have your device in your possession, you also likely have your key in your possession in order to use your device.

If your threat profile really includes the possibility of getting hit by a wrench, you can devise a means of destroying the key quickly.

Re: How to Yubikey

#100

Post by Mindless2112 »

sheerun wrote: post #21

I really would like to use it, but without ability to backup it, I don't wanna. I've read some time ago Yubikey of some other company showed initial spec, but I never heard any followup, I don't remember the link. For now I'm using TOTP but it's a chore. Salesforce Authenticator has nice idea with custom push-based protocol, but it's not running on dedicated hardware. I think ESP32 S3 has hardware potential to act as…

Here [1] is Yubico's draft WebAuthn recovery ("backup authenticator") extension spec, which is possibly what you're thinking of.

[1] https://github.com/Yubico/webauthn-recovery-extension

Post reply on HN