Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by jmunsch | Hacker News Reader

Full thread

jmunsch·

That's awesome. Also very cool to see u2f/fido support for ssh.

https://wiki.ubuntu.com/FocalFossa/ReleaseNotes

View on HN

Does it only support ecdsa? Surprised they don't use ed25519 in their example.

Edit: nope, seems ed25519 supported too https://manpages.ubuntu.com/manpages/focal/en/man1/ssh-keyge... although internet seems to suggest hardware support is far more limited. Tried generating one on MacOS and indeed my Yubikey seems unsupported.

Unfortunately, you can't use Ed25519 keys unless you have the latest/newest model(s) of Yubikey and that Yubikey came with at least a specific firmware version (5.2.3, IIRC).

YEAH!! Finally. Trying to assemble my own rube goldberg machine for key access is exhausting.

What? What do you mean? Could you show an explanation of what you're trying to achieve? Genuinely interested.

Using a hardware token as the authenticator for SSH sessions. Taken to the fullest, this allows you to completely avoid password authentication for SSH, except for the initial upload of your public key.

Thanks! That makes sense. I don't get the name, but this is what we call that now?

U2F/Fido refers mainly to doing through the browser, but as you probably know, the browser is only the end of the line of a long chain of usability oriented changes. It's been a decade in the making. Now SSH is using that mechanism, just not through the browser. Personally I'm psyched, lots of apps can start using this approach and get a great user experience!

It looks like it's not terribly portable (I can't walk up to a machine, plug my key in and SSH home), but it's really easy to set up with one command.

Awesome! Love my yubikey.

Reply on news.ycombinator.com