Hacker News Reader

Comment by im_down_w_otp | Hacker News Reader

I used to have my laptop setup to require my specific Yubikey to be inserted to allow waking from sleep and booting, and when you pulled it out it locked the machine, logged you out, suspended, or shutdown depending on which modifier key you were holding down when you removed it.

Worked pretty well as a "kill switch" when getting up from my desk.

I probably have the udev scripts laying around somewhere.

View on HN

I'm using a similar setup on macOS, except mine does not use modifier keys; it just logs me out.

YubiCo even provides the documentation to set it up via OpenSC. I guess you can also set macOS up to hibernate and destroy the FileVault key.

(My adversary is not government etc (who can execute a cold boot attack anyway), it is thieves while I'm in transit, and clients around the office.)

Just curious; is this the Yubico guide you're referring to?

macOS Logon Tool Configuration Guide https://support.yubico.com/support/solutions/articles/150000...

Unfortunately, it's not currently compatible with Catalina.

Here are a few more resources for macOS users:

Simple Daemon for lock and unlock macOS with Yubikey https://podtynnyi.com/2017/03/07/simple-daemon-for-lock-and-...

Locking macOS to a Yubikey 4 with PIV and PAM https://www.richard-purves.com/2017/02/13/locking-macos-with...

HOW to lock and unlock screen upon removal and insertion of Yubikey on macOS https://confluence.panio.info/display/PUBL/HOW+to+lock+and+u...

No, that guide uses PAM and OTP. This [1] is the guide. It uses OpenSC and the smartcard feature of the YubiKey (not all support this but my YubiKey Neo (3rd gen) and YubiKey Nano 4 both do). Neither of them supports FIDO2 though; other than that they are feature rich.

[1] https://support.yubico.com/support/solutions/articles/150000...

Thanks so much for your reply, Fnoord.

Does that approach allow instantly locking the screen if the YubiKey is removed? It's not mentioned in the guide, so I just want to be sure.

Yes, it does, though I had to set it to lock immediately in System Preferences (triggers immediately the screensaver; first guide you linked explains how to do this). I'm using the Word Of The Day screensaver, so it is really inspiring to get back from grabbing a cup of coffee.

Also, remember you only need to enter the PIN, which I'd argue is a good thing as I don't want to enter my password in public (I don't even know my password out of my head). If you boot up, you need a password of a username to unlock FileVault, but I use a different username for that (who does not have root, though for forensics this is an attack vector).

And enable "Turn on screensaver when login token is removed" at System Preferences -> Security & Privacy -> General -> Advanced

Sounds like a good way to hit the 10k usb-c lifespan

Isn't USB-C designed to wear out the cable (or dongle) and not the port?

So if you used a Yubikey to log in and out ten times a day, you might need to replace it every three years. Of course you'll make the same amount of connections if you require it only for login, assuming you don't leave it connected.

Lets see. Say you work 5 days a week. That's about 260 days a year (without vacations etc). Say you unlock your device 4 times a day when you work. That is 1040 times a year. Does your device even last 9-10 years? Well, if it is a MacBook, Apple ditched support for all <= 2012 MBPs. Not sure when they did, but this was true at start of last year for sure.

I have a Macbook Air 2012 which is still supported by Apple (I get new OSes and OS updates every year).

Try to get the screen or battery replaced. To be fair, they're easier user serviceable than newer MB(A/P)s. For example, me with my MBP 2015 will have a harder time to service it once it gets EOL (hardware-wise) than you have now with your MBA 2012.

I've replaced the battery twice, last time in september 2019, and this last time it costed me 60 EUR, and the battery life is much better than the original one.

I might want to replace the battery again in the next 3-4 years if I still have this laptop, and you might be right in that this might not be possible, but at least today it is.

Oh it is likely possible via iFixit or other aftermarket. Just not officially via Apple.

Yep, I just googled my model + battery, and ordered a new battery from iFixit. Took like 15 min to swap the battery myself.

I would definitely unlock my device more than four times a day. Often times my periods of focus last 30 minutes. Half the time that’s a task switch, the other half I get up to walk. This doesn’t account for meetings interrupting me.

Reply on news.ycombinator.com