7 ms·
This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for! https://github.com/philipWendland/IsoApplet/wiki https://
by xaduha 8y ago
This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for!
https://github.com/philipWendland/IsoApplet/wiki https://github.com/philipWendland/IsoApplet/wiki
- jplayer01 8y agoWait, really? They still make these? People still use them? How secure are they really compared to USB tokens like a Yubikey? How do you interface with one of these?
- cmehdy 8y agoSome yubikeys provide smart-card functionality. https://www.yubico.com/solutions/smart-card/ https://www.yubico.com/solutions/smart-card/
- pmorici 8y agoThey all do it is just a matter of how the end user configures them.
- pimlottc 8y agoNot true; the cheaper blue "Security Key" model only supports FIDO and U2F. https://www.yubico.com/store/#SKY https://www.yubico.com/store/#SKY https://www.yubico.com/product/security-key-by-yubico/ https://www.yubico.com/product/security-key-by-yubico/
- StavrosK 8y agoThose aren't Yubikeys, though. They're Yubico security keys.
- pimlottc 8y agoHuh, I guess you are technically correct. They are listed on the Yubikey product page, though, and Yubikey is so strongly associated with Yubico that the distinction is easily lost.
- StavrosK 8y agoYeah, that's unfortunate, because someone can easily mistake them for Yubikeys. They're basically WebAuthn keys.
- akerl_ 8y agoThis page has a “Using your Yubikey” section: https://www.yubico.com/product/security-key-by-yubico/#security-key https://www.yubico.com/product/security-key-by-yubico/#secur... I think it’s pretty impossible to expect people to look at these keys and think “ah yes, this is a Yubico Security Key, not a Yubikey”, given they look like a painted yubikey, are sold by the same company, have some feature overlap, and the docs are commingled with yubikey docs.
- xaduha 8y ago> USB tokens like a Yubikey As far as I can tell first Yubikeys were basically small cardreaders with non-removable smartcards in SIM card formfactor. > Wait, really? They still make these? Every credit card with a chip is basically a smartcard, every SIM card too. Smart cards are not going anywhere. > How do you interface with one of these? CCID cardreader + OpenSC
- jbnorth 8y agoThe DoD uses them extensively. All military personnel are issued one and it’s used for everything from accessing workstations and email to buying your meals at the DFAC.
- noinsight 8y ago> Wait, really? They still make these? People still use them? Mandated by the US government so yes, lots of people use them. https://en.wikipedia.org/wiki/Common_Access_Card https://en.wikipedia.org/wiki/Common_Access_Card
- chx 8y agoYeah, and that's just the DoD, even the US Forest Service mandates the use of a smartcard to log in to their VPN.
- pimlottc 8y agoCACs are just within the Department of Defense (+ Coast Guard). In the wider Federal government, they are called PIVs and use a slightly different standard: https://en.wikipedia.org/wiki/FIPS_201 https://en.wikipedia.org/wiki/FIPS_201
- LeonM 8y agoJust about every Dell and Lenovo laptop from the enterprise lineup still comes with a SC reader option. In the enterprise world, smartcards are the de facto standard. I've heard complaints from $BIGCORP managers that they couldn't have iPads because they don't offer smartcard functionality.
- jplayer01 8y agoSomehow I managed to snag one of the Thinkpad models that doesn't have an SC reader option (T420p), which is disappointing, because this seemed like a cool thing to look into and experiment with.
- icebraining 8y agoIn some countries, every national ID card is a smartcard, so millions of people use them. You can authenticate against our IRS site with yours, for example.
- akerl_ 8y agoWhat do actual card-form-factor “smartcards” get me over using the CCID interface on the Yubikey?
- xaduha 8y agoNot much as far as SSH is concerned, but you can buy many smart cards and just use one cardreader. For personal use it's more convenient to use Yubikey as a commercial proprietary solution.
- akerl_ 8y agoI guess it depends. If I’ve got a fleet of users with commodity laptops, and I want them to do CCID auth, I could buy them each a card reader and a card, or I could buy them each a yubikey and use their USB port. Things are different if this is the DoD or somewhere that’s already got card readers as a core component, but if this is the DoD, I’m already winning because I get to use their PKI/cards and don’t have to build my own PKI :D
- floatboth 8y agoProper ThinkPads (e.g. A285, X390, A485, T490) come with a card reader option for regular consumers