Hacker News Reader

Comment by jplayer01 | Hacker News Reader

Wait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?

View on HN

> USB tokens like a Yubikey

As far as I can tell first Yubikeys were basically small cardreaders with non-removable smartcards in SIM card formfactor.

> Wait, really? They still make these?

Every credit card with a chip is basically a smartcard, every SIM card too. Smart cards are not going anywhere.

> How do you interface with one of these?

CCID cardreader + OpenSC

Just about every Dell and Lenovo laptop from the enterprise lineup still comes with a SC reader option. In the enterprise world, smartcards are the de facto standard. I've heard complaints from $BIGCORP managers that they couldn't have iPads because they don't offer smartcard functionality.

Somehow I managed to snag one of the Thinkpad models that doesn't have an SC reader option (T420p), which is disappointing, because this seemed like a cool thing to look into and experiment with.

Some yubikeys provide smart-card functionality. https://www.yubico.com/solutions/smart-card/

They all do it is just a matter of how the end user configures them.

Not true; the cheaper blue "Security Key" model only supports FIDO and U2F.

https://www.yubico.com/store/#SKY https://www.yubico.com/product/security-key-by-yubico/

Those aren't Yubikeys, though. They're Yubico security keys.

Huh, I guess you are technically correct. They are listed on the Yubikey product page, though, and Yubikey is so strongly associated with Yubico that the distinction is easily lost.

Yeah, that's unfortunate, because someone can easily mistake them for Yubikeys. They're basically WebAuthn keys.

This page has a “Using your Yubikey” section: https://www.yubico.com/product/security-key-by-yubico/#secur...

I think it’s pretty impossible to expect people to look at these keys and think “ah yes, this is a Yubico Security Key, not a Yubikey”, given they look like a painted yubikey, are sold by the same company, have some feature overlap, and the docs are commingled with yubikey docs.

> Wait, really? They still make these? People still use them?

Mandated by the US government so yes, lots of people use them.

https://en.wikipedia.org/wiki/Common_Access_Card

Yeah, and that's just the DoD, even the US Forest Service mandates the use of a smartcard to log in to their VPN.

CACs are just within the Department of Defense (+ Coast Guard). In the wider Federal government, they are called PIVs and use a slightly different standard:

https://en.wikipedia.org/wiki/FIPS_201

The DoD uses them extensively. All military personnel are issued one and it’s used for everything from accessing workstations and email to buying your meals at the DFAC.

In some countries, every national ID card is a smartcard, so millions of people use them. You can authenticate against our IRS site with yours, for example.

Reply on news.ycombinator.com