4 ms·

I've got several (~7?) Yubikeys: one that Mt. Gox sent me several years ago (that would only work with their web site!), an old "Symantec VIP" key, a NEO that's

I've got several (~7?) Yubikeys: one that Mt. Gox sent me several years ago (that would only work with their web site!), an old "Symantec VIP" key, a NEO that's permanently plugged into the keyboard on my workstation, a couple of Nanos (almost always plugged into a pair of laptops), and a couple of the U2F-only ones. I don't think I've ever had any issues with any of them (there was a "bug" a few years back and they had to "re-issue" some keys) and I really don't have any big complaints other than they're a little expensive (but I keep buying them so apparently not too expensive), just a few minor things. I've never actually used the U2F ones (browser usage is ~90% Chromium, ~10% Firefox, on Linux exclusively) but maybe I'll get to someday. The NEO and Nanos get used dozens of times a day as my SSH keys (GPG subkeys) are on them. They're also used for unlocking LUKS containers at boot (challenge/response, with a "passphrase"). I do wish it was easier to load (SSL/TLS) certificates on them -- and I wish they held more of them! -- but I have a bunch of physical ("real") smart cards so I just use those instead. Ideally, I'd be able to put certificates on them and use them to authenticate (Open)VPN clients on both Linux and Windows. That might even be possible today but, if it is, it's likely way more complicated than it should be. Oh, also I used the VIP and NEO at one point with LastPass and they worked great (but I switched from LastPass when LogMeIn bought them).

sasas 9y ago
> Oh, also I used the VIP and NEO at one point with LastPass and they worked great Have you tried logging into LastPass on your mobile device? It doesn't require the token - effectively bypassing the point of requiring a hardware token in the first place ..
- jlgaddis 9y ago
  I haven't, actually, but I'm not really that surprised (I moved off of LastPass two years or so ago, a few hours after they were bought). I think you can restrict access via TouchID (on the iPhone) but don't quote me on that.
- ago 9y ago
  That was my problem first too, but you can make it require the token on mobile too. I have it set up that way and I need to tap my Yubikey NEO to authenticate using NFC on Android. Works great.
hdhzy 9y ago
> I do wish it was easier to load (SSL/TLS) certificates on them What do you mean by "easier"? Yubico PIV manager is super simple to use. Of course you have to generate the certificate with OpenSSL yourself but that's part of the process. And the PIV certificates are automatically seen by OS. I'm using them in browser, git can be switched to use system certificate store effectively having hardware protected access to repos. SSH can also use them either via OpenSC or Putty CAC (depending on your OS). I've done that and it works, it's not much harder than the OpenPGP setup.
- Corrado 9y ago
  The downside to doing this on my Nano is that the CCID mode causes the light on the Yubikey to blink constantly. The only way to shut it off is to disable CCID mode. Who thought this was a good idea?!?

sasas 9y ago

> Oh, also I used the VIP and NEO at one point with LastPass and they worked great Have you tried logging into LastPass on your mobile device? It doesn't require the token - effectively bypassing the point of requiring a hardware token in the first place ..

jlgaddis 9y ago
I haven't, actually, but I'm not really that surprised (I moved off of LastPass two years or so ago, a few hours after they were bought). I think you can restrict access via TouchID (on the iPhone) but don't quote me on that.
ago 9y ago
That was my problem first too, but you can make it require the token on mobile too. I have it set up that way and I need to tap my Yubikey NEO to authenticate using NFC on Android. Works great.

hdhzy 9y ago

> I do wish it was easier to load (SSL/TLS) certificates on them What do you mean by "easier"? Yubico PIV manager is super simple to use. Of course you have to generate the certificate with OpenSSL yourself but that's part of the process. And the PIV certificates are automatically seen by OS. I'm using them in browser, git can be switched to use system certificate store effectively having hardware protected access to repos. SSH can also use them either via OpenSC or Putty CAC (depending on your OS). I've done that and it works, it's not much harder than the OpenPGP setup.

Corrado 9y ago
The downside to doing this on my Nano is that the CCID mode causes the light on the Yubikey to blink constantly. The only way to shut it off is to disable CCID mode. Who thought this was a good idea?!?