Hacker News Reader

Comment by tptacek | Hacker News Reader

It's worth considering: almost nobody who uses Yubikeys loves them, but they are by a wide margin the tokens experts recommend most.

View on HN

I use my yubikey and I love it. I have it set up to do GPG, SSH, TOTP, and U2F and it works great. It is worlds better then any other Smart Card or second factor out there, and U2F is literally just plug it in and tap it.

The U2F bit is a dream, yes. The rest of it not so much.

What do you recommend?

Have you got a writeup of the ssh setup methodology you used?

(I've tried scouting around, but not found anything clear yet. Someone's done native support in ssh, but the patch set is hung up on licensing issues and technical quibbles[1], and some of the PAM-based setups seem to require cut-and-paste of crypto strings on every login.)

[1] https://bugzilla.mindrot.org/show_bug.cgi?id=2319

I use this:

http://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-ss...

Coupled with a standard yubikey+gpg agent setup

Maybe look at my dotfiles if you are stuck:

- https://github.com/aviau/dotfiles

Thanks!

Is there any sort of backup in case it gets destroyed or lost? Can you clone it?

The only backup I know of is getting another key that you register in the same way as the first key.

Hopefully they don't both break at the same time.

The entire security model depends on the devices being uncloneable.

But my security model does not allow putting myself in a position where I am stranded without my second factor (or doing huge amounts of work re-registering everything).

That's why you set up backup factors.

It is for the same reason that services like Google Mail won't let you set up a U2F token without a backup factor.

The problem is largely with their docs, or lack thereof. Just figuring out how to use one as a token for ssh is incredibly painful. The docs are very "enterprise," meaning half-done, overly complicated, confusing, scattered, etc.

It is extraordinarily annoying to set up a Y4 for SSH. We use gpg-agent in ssh-agent compat mode.

It would be better if they supported the OpenSSH PKI format.

There was a series of changes, e.g. regarding platform keys, software source availability etc etc. I think there were some "I don't endorse this anymore" posts, although I don't really remember the details.

I've read "I don't endorse this" from open source advocates, but none from crypto engineers.

Reply on news.ycombinator.com