YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
1–10 of 45 posts
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#2And apparently with macOS Sierra it's possible to once again use a Yubikey to configure login on a Mac. I'd missed that news, will have to go dig mine out of the drawer!
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#3And apparently with macOS Sierra it's possible to once again use a Yubikey to configure login on a Mac. I'd missed that news, will have to go dig mine out of the drawer!
How useful is that, really, considering you couldn't possibly use a Yubikey to configure disk encryption? Unless you actually put the unlock key on the Yubikey somehow (I've never heard of someone attempting or succeeding at that), anyone with physical access - which is what this is intended to protect against - could still wreak all kinds of havoc with disk access.
It's certainly easier and may even be safer (in the case of a malfunction, which has happened on OSX) to just use a longer password.
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#4And apparently with macOS Sierra it's possible to once again use a Yubikey to configure login on a Mac. I'd missed that news, will have to go dig mine out of the drawer!
How useful is that, really, considering you couldn't possibly use a Yubikey to configure disk encryption? Unless you actually put the unlock key on the Yubikey somehow (I've never heard of someone attempting or succeeding at that), anyone with physical access - which is what this is intended to protect against - could still wreak all kinds of havoc with disk access. It's certainly easier and may even be safer (in the…
I wonder if one of the coreboot/openboot/whatever could implement that. I don't know enough about that part of the stack to know whose responsibility it is to implement it.
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#5And apparently with macOS Sierra it's possible to once again use a Yubikey to configure login on a Mac. I'd missed that news, will have to go dig mine out of the drawer!
How useful is that, really, considering you couldn't possibly use a Yubikey to configure disk encryption? Unless you actually put the unlock key on the Yubikey somehow (I've never heard of someone attempting or succeeding at that), anyone with physical access - which is what this is intended to protect against - could still wreak all kinds of havoc with disk access. It's certainly easier and may even be safer (in the…
With FileVault, the disk won't decrypt until the user enters their login password.
Here's Yubico's documentation on Filevault integration: https://www.yubico.com/support/knowledge-base/categories/art...
It seems an attacker with physical access still requires your password to unlock the disk. At that point, they'd need the Yubikey to login (assuming they haven't already decrypted the disk and taken your data).
Someone on Reddit suggested saving a static password to the Yubikey and then entering that at boot time to get around this: https://www.reddit.com/r/AskNetsec/comments/3dpa2q/how_do_yo...?
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#6I have never owned a YubiKey before. What happens if you lose it or if it gets damaged? Can you get it replaced or is it like losing a keyfile?
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#7I have never owned a YubiKey before. What happens if you lose it or if it gets damaged? Can you get it replaced or is it like losing a keyfile?
You lose it and it's gone. You can't remove credentials on the device. This is why you buy two, register both, and save one in a safe.
EDIT: I mean you can't copy credentials off in most cases, like this one. Credentials can be replaced.
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#8And apparently with macOS Sierra it's possible to once again use a Yubikey to configure login on a Mac. I'd missed that news, will have to go dig mine out of the drawer!
How useful is that, really, considering you couldn't possibly use a Yubikey to configure disk encryption? Unless you actually put the unlock key on the Yubikey somehow (I've never heard of someone attempting or succeeding at that), anyone with physical access - which is what this is intended to protect against - could still wreak all kinds of havoc with disk access. It's certainly easier and may even be safer (in the…
I actually keep my FDE password separate just because I use such a long password it's not practical to type every time my screen locks. The GUI doesn't expose it, but you can encrypt your root volume independent of your user account directly with a "diskutil cs encryptVolume" command. There's a great writeup of it here: https://www.westhoffswelt.de/blog/2014/9/9/osx-full-disk-enc...
I think a physical token for the user account is still good for times when one I'm just away from the desk for a bit, a physical key is better than a short password that someone could probably shoulder surf me typing 50 times a day anyway.
There seems to be some info on using the Yubikey with FDE on their site, it's worth a look but indeed, I'm not sure there's anything that they could do there beyond effectively storing said really long password anyway.
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#9I have never owned a YubiKey before. What happens if you lose it or if it gets damaged? Can you get it replaced or is it like losing a keyfile?
You lose it and it's gone. You can't remove credentials on the device. This is why you buy two, register both, and save one in a safe. EDIT: I mean you can't copy credentials off in most cases, like this one. Credentials can be replaced.
If you program your own keys into the Yubi, then you know them and can archive them for reprogramming on another device. You can do this with the Yubi Personalisation tool [1] for a few modes the device supports.
[1] https://www.yubico.com/products/services-software/personaliz...
Re: YubiKey for Windows Hello – Protect your Windows 10 login with your YubiKey
#10I have never owned a YubiKey before. What happens if you lose it or if it gets damaged? Can you get it replaced or is it like losing a keyfile?
Pretty much every online service that supports it has a backup 2FA method that you are required to set up. I use Google Authenticator on my phone because my phone doesn't have NFC.