5 ms·
Using zx2c4 pass with a Yubikey 4. Passwords are GPG encrypted. The private key is on the Yubikey and cannot be read out. The Yubikey 4 is set to require a touc
by danjoc 10y ago
Using zx2c4 pass with a Yubikey 4. Passwords are GPG encrypted. The private key is on the Yubikey and cannot be read out. The Yubikey 4 is set to require a touch per password unlock. The only passwords at risk are the ones unlocked. At that point, the trojan could install a keylogger and have the same amount of success.
Losing the password store isn't a problem either. It has a git remote on a USB stick. There's a backup if it's ever lost.
- DanBlake 10y agoThis is interesting. I am not well versed on yubikey, but does it allow you to have a similar setup with other password managers, like keepass? (Meaning, one press per one password) Or is it just a substitute for typing a master password?
- danjoc 10y agoThere are several integrations, but I don't have Google Play Services on my phone, so I only use what's available via F-Droid. See my other comment in this thread. https://www.yubico.com/support/partners/#password-management https://www.yubico.com/support/partners/#password-management The touch setting is specific to OpenPGP keys. If you set it, it works that way for all uses of your OpenPGP key. You can turn it on to see if you like it. If you do, you can also set it to 'fix.' Once fixed, it can never be turned off again without deleting the private key and starting over. https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_touch https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_...
- irremediable 10y agoIn that setup, how do you handle needing passwords on your phone?
- Fnoord 10y agoWhich phone? If it is Android, you could root it and use the same commands. Else, if you don't want to root or are using iOS there is software available for LastPass and 1Password.
- danjoc 10y agoThere's an app for that. Android Password Store[1]. You can use a Yubikey Neo with NFC in combination with Open Keychain[2]. Both are available on F-Droid. [1]https://github.com/zeapo/Android-Password-Store https://github.com/zeapo/Android-Password-Store [2]https://github.com/open-keychain/open-keychain https://github.com/open-keychain/open-keychain
- smartbit 10y agoIn the case you what to use the some passwords on iDevices, what would you recommend for password db? EDIT: irremediable posed the same question at the same time ;-)
- danjoc 10y agoiOS doesn't have an NFC API. Thanks Apple. https://www.yubico.com/products/yubikey-hardware/yubikey-neo/#toggle-id-8 https://www.yubico.com/products/yubikey-hardware/yubikey-neo... Works okay on Mac OS with GPGTools and QTPass.
- clarry 10y agoSo what happens when you lose the yubikey?
- danjoc 10y agoYou can encrypt a folder to multiple public keys. Good for having a backup yubikey, sharing a group of passwords with a spouse or other vip, etc.