How to Yubikey
debugging.works
How to Yubikey
1–10 of 186 posts
Re: How to Yubikey
#2For full disk encryption, if you use systemd and not another init system, i'd also recommend systemd-cryptsetup, it's already installed on your machine if you have a relatively new systemd (at least 248). With systemd-cryptsetup you can use fido2, and your normal fido2 pin, to unlock your LUKS drive.
This also works with the YubiKeys "Security Key" series, that only have fido2 and no otp/chalresp.
Re: How to Yubikey
#3For OTP secrets, you could add my yubikey-otp tool, which is a CLI tool for searching and adding otp secrets stored on your YubiKey to your clipboard: https://github.com/MarkusZoppelt/yubikey-otp
Re: How to Yubikey
#4Since it mentions age and rage: there is also dage, a Dart implementation https://github.com/Producement/dage .
Also there is age-yubikey-pgp which uses dage to allow you to use X25519 for file encryption/decryption https://github.com/Producement/age-yubikey-pgp
Re: How to Yubikey
#5Reminder: Yubico doesn't have a monopoly on security keys. Make sure your software/tutorials support the open-source alternatives like OnlyKey and NitroKey.
Re: How to Yubikey
#6Great, modern guide. Thanks!
While I have a few Yubikeys in a drawer somewhere, for years I've preferred to use an actual smartcard to store my keys. Sure, it only offers a subset of the features of a USB key, but I've found that I really only need to sign, auth and decrypt data. All the other fancy things like OTP, FIDO, etc., either have alternatives (e.g. pass-otp), or are just not used often enough. I haven't been in a situation yet where I _need_ to use a USB key.
Besides, the experience of using Yubikeys always annoyed me. The touch functionality was way too sensitive, causing many unwanted triggers. Having it always stick out made me nervous it was going to break. And the small USB-C version was often difficult to remove, while also taking up a USB slot.
Smartcards are nice since they're compact and stay neatly inside a laptop, and they use a separate interface for that purpose, instead of the generic USB. I wish more laptops had readers for them.
Re: How to Yubikey
#7The thing missing for me is, how to set 2 yubikeys to be functionally the same, to make having a backup key easier (for situations where no data is added to the key)
Re: How to Yubikey
#8Great, modern guide. Thanks! While I have a few Yubikeys in a drawer somewhere, for years I've preferred to use an actual smartcard to store my keys. Sure, it only offers a subset of the features of a USB key, but I've found that I really only need to sign, auth and decrypt data. All the other fancy things like OTP, FIDO, etc., either have alternatives (e.g. pass-otp), or are just not used often enough. I haven't bee…
Which card are you using?
Re: How to Yubikey
#9The thing missing for me is, how to set 2 yubikeys to be functionally the same, to make having a backup key easier (for situations where no data is added to the key)
You have to register each key individually.
Re: How to Yubikey
#10don't be overwhelmed by these guides - you can also use yubikeys "out of the box"
I use mine as a 2FA on services that support it, and I've never had to do anything but plug it in
remember though, you will need pc smart card support...typically the pcscd daemon must be started and enabled