Hacker News Reader

Comment by dkhenry | Hacker News Reader

I use my yubikey and I love it. I have it set up to do GPG, SSH, TOTP, and U2F and it works great. It is worlds better then any other Smart Card or second factor out there, and U2F is literally just plug it in and tap it.

View on HN

Have you got a writeup of the ssh setup methodology you used?

(I've tried scouting around, but not found anything clear yet. Someone's done native support in ssh, but the patch set is hung up on licensing issues and technical quibbles[1], and some of the PAM-based setups seem to require cut-and-paste of crypto strings on every login.)

[1] https://bugzilla.mindrot.org/show_bug.cgi?id=2319

I use this:

http://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-ss...

Coupled with a standard yubikey+gpg agent setup

Maybe look at my dotfiles if you are stuck:

- https://github.com/aviau/dotfiles

Thanks!

The U2F bit is a dream, yes. The rest of it not so much.

What do you recommend?

Is there any sort of backup in case it gets destroyed or lost? Can you clone it?

The only backup I know of is getting another key that you register in the same way as the first key.

Hopefully they don't both break at the same time.

The entire security model depends on the devices being uncloneable.

But my security model does not allow putting myself in a position where I am stranded without my second factor (or doing huge amounts of work re-registering everything).

That's why you set up backup factors.

It is for the same reason that services like Google Mail won't let you set up a U2F token without a backup factor.

Reply on news.ycombinator.com