Hacker News Reader

Comment by xaduha | Hacker News Reader

This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for!

https://github.com/philipWendland/IsoApplet/wiki

What do actual card-form-factor “smartcards” get me over using the CCID interface on the Yubikey?

Not much as far as SSH is concerned, but you can buy many smart cards and just use one cardreader. For personal use it's more convenient to use Yubikey as a commercial proprietary solution.

I guess it depends. If I’ve got a fleet of users with commodity laptops, and I want them to do CCID auth, I could buy them each a card reader and a card, or I could buy them each a yubikey and use their USB port.

Things are different if this is the DoD or somewhere that’s already got card readers as a core component, but if this is the DoD, I’m already winning because I get to use their PKI/cards and don’t have to build my own PKI :D

Proper ThinkPads (e.g. A285, X390, A485, T490) come with a card reader option for regular consumers

Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?

Some yubikeys provide smart-card functionality. https://www.yubico.com/solutions/smart-card/

They all do it is just a matter of how the end user configures them.

Not true; the cheaper blue "Security Key" model only supports FIDO and U2F.

https://www.yubico.com/store/#SKY https://www.yubico.com/product/security-key-by-yubico/

Those aren't Yubikeys, though. They're Yubico security keys.

Huh, I guess you are technically correct. They are listed on the Yubikey product page, though, and Yubikey is so strongly associated with Yubico that the distinction is easily lost.

Yeah, that's unfortunate, because someone can easily mistake them for Yubikeys. They're basically WebAuthn keys.

This page has a “Using your Yubikey” section: https://www.yubico.com/product/security-key-by-yubico/#secur...

I think it’s pretty impossible to expect people to look at these keys and think “ah yes, this is a Yubico Security Key, not a Yubikey”, given they look like a painted yubikey, are sold by the same company, have some feature overlap, and the docs are commingled with yubikey docs.

> USB tokens like a Yubikey

As far as I can tell first Yubikeys were basically small cardreaders with non-removable smartcards in SIM card formfactor.

> Wait, really? They still make these?

Every credit card with a chip is basically a smartcard, every SIM card too. Smart cards are not going anywhere.

> How do you interface with one of these?

CCID cardreader + OpenSC

The DoD uses them extensively. All military personnel are issued one and it’s used for everything from accessing workstations and email to buying your meals at the DFAC.

> Wait, really? They still make these? People still use them?

Mandated by the US government so yes, lots of people use them.

https://en.wikipedia.org/wiki/Common_Access_Card

Yeah, and that's just the DoD, even the US Forest Service mandates the use of a smartcard to log in to their VPN.

CACs are just within the Department of Defense (+ Coast Guard). In the wider Federal government, they are called PIVs and use a slightly different standard:

https://en.wikipedia.org/wiki/FIPS_201

Just about every Dell and Lenovo laptop from the enterprise lineup still comes with a SC reader option. In the enterprise world, smartcards are the de facto standard. I've heard complaints from $BIGCORP managers that they couldn't have iPads because they don't offer smartcard functionality.

Somehow I managed to snag one of the Thinkpad models that doesn't have an SC reader option (T420p), which is disappointing, because this seemed like a cool thing to look into and experiment with.

In some countries, every national ID card is a smartcard, so millions of people use them. You can authenticate against our IRS site with yours, for example.

Reply on news.ycombinator.com