5 ms·

I use my yubikey and I love it. I have it set up to do GPG, SSH, TOTP, and U2F and it works great. It is worlds better then any other Smart Card or second facto

I use my yubikey and I love it. I have it set up to do GPG, SSH, TOTP, and U2F and it works great. It is worlds better then any other Smart Card or second factor out there, and U2F is literally just plug it in and tap it.

tptacek 9y ago
The U2F bit is a dream, yes. The rest of it not so much.
- akulbe 9y ago
  What do you recommend?
rst 9y ago
Have you got a writeup of the ssh setup methodology you used? (I've tried scouting around, but not found anything clear yet. Someone's done native support in ssh, but the patch set is hung up on licensing issues and technical quibbles[1], and some of the PAM-based setups seem to require cut-and-paste of crypto strings on every login.) [1] https://bugzilla.mindrot.org/show_bug.cgi?id=2319 https://bugzilla.mindrot.org/show_bug.cgi?id=2319
- ReAzem 9y ago
  I use this: http://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-ssh-agent-setup/ http://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-ss... Coupled with a standard yubikey+gpg agent setup Maybe look at my dotfiles if you are stuck: - https://github.com/aviau/dotfiles https://github.com/aviau/dotfiles
  - rst 9y ago
    Thanks!
atmosx 9y ago
Is there any sort of backup in case it gets destroyed or lost? Can you clone it?
- nobodyorother 9y ago
  The only backup I know of is getting another key that you register in the same way as the first key. Hopefully they don't both break at the same time.
- tptacek 9y ago
  The entire security model depends on the devices being uncloneable.
  - noja 9y ago
    But my security model does not allow putting myself in a position where I am stranded without my second factor (or doing huge amounts of work re-registering everything).
    - tptacek 9y ago
      That's why you set up backup factors. It is for the same reason that services like Google Mail won't let you set up a U2F token without a backup factor.
  - deleted 9y ago
    [deleted]

tptacek 9y ago

The U2F bit is a dream, yes. The rest of it not so much.

akulbe 9y ago
What do you recommend?

rst 9y ago

Have you got a writeup of the ssh setup methodology you used? (I've tried scouting around, but not found anything clear yet. Someone's done native support in ssh, but the patch set is hung up on licensing issues and technical quibbles[1], and some of the PAM-based setups seem to require cut-and-paste of crypto strings on every login.) [1] https://bugzilla.mindrot.org/show_bug.cgi?id=2319 https://bugzilla.mindrot.org/show_bug.cgi?id=2319

ReAzem 9y ago
I use this: http://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-ssh-agent-setup/ http://www.bootc.net/archives/2013/06/09/my-perfect-gnupg-ss... Coupled with a standard yubikey+gpg agent setup Maybe look at my dotfiles if you are stuck: - https://github.com/aviau/dotfiles https://github.com/aviau/dotfiles
- rst 9y ago
  Thanks!

atmosx 9y ago

Is there any sort of backup in case it gets destroyed or lost? Can you clone it?

nobodyorother 9y ago
The only backup I know of is getting another key that you register in the same way as the first key. Hopefully they don't both break at the same time.
tptacek 9y ago
The entire security model depends on the devices being uncloneable.
- noja 9y ago
  But my security model does not allow putting myself in a position where I am stranded without my second factor (or doing huge amounts of work re-registering everything).
  - tptacek 9y ago
    That's why you set up backup factors. It is for the same reason that services like Google Mail won't let you set up a U2F token without a backup factor.
- deleted 9y ago
  [deleted]