6 ms·

I used to have my laptop setup to require my specific Yubikey to be inserted to allow waking from sleep and booting, and when you pulled it out it locked the ma

I used to have my laptop setup to require my specific Yubikey to be inserted to allow waking from sleep and booting, and when you pulled it out it locked the machine, logged you out, suspended, or shutdown depending on which modifier key you were holding down when you removed it. Worked pretty well as a "kill switch" when getting up from my desk. I probably have the udev scripts laying around somewhere.

asia92 7y ago
Sounds like a good way to hit the 10k usb-c lifespan
- dancek 7y ago
  Isn't USB-C designed to wear out the cable (or dongle) and not the port? So if you used a Yubikey to log in and out ten times a day, you might need to replace it every three years. Of course you'll make the same amount of connections if you require it only for login, assuming you don't leave it connected.
- Fnoord 7y ago
  Lets see. Say you work 5 days a week. That's about 260 days a year (without vacations etc). Say you unlock your device 4 times a day when you work. That is 1040 times a year. Does your device even last 9-10 years? Well, if it is a MacBook, Apple ditched support for all <= 2012 MBPs. Not sure when they did, but this was true at start of last year for sure.
  - fluffything 7y ago
    I have a Macbook Air 2012 which is still supported by Apple (I get new OSes and OS updates every year).
    - Fnoord 7y ago
      Try to get the screen or battery replaced. To be fair, they're easier user serviceable than newer MB(A/P)s. For example, me with my MBP 2015 will have a harder time to service it once it gets EOL (hardware-wise) than you have now with your MBA 2012.
      - fluffything 7y ago
        I've replaced the battery twice, last time in september 2019, and this last time it costed me 60 EUR, and the battery life is much better than the original one. I might want to replace the battery again in the next 3-4 years if I still have this laptop, and you might be right in that this might not be possible, but at least today it is.
        Fnoord 7y ago
        Oh it is likely possible via iFixit or other aftermarket. Just not officially via Apple.
        fluffything 7y ago
        Yep, I just googled my model + battery, and ordered a new battery from iFixit. Took like 15 min to swap the battery myself.
  - CardenB 7y ago
    I would definitely unlock my device more than four times a day. Often times my periods of focus last 30 minutes. Half the time that’s a task switch, the other half I get up to walk. This doesn’t account for meetings interrupting me.
Fnoord 7y ago
I'm using a similar setup on macOS, except mine does not use modifier keys; it just logs me out. YubiCo even provides the documentation to set it up via OpenSC. I guess you can also set macOS up to hibernate and destroy the FileVault key. (My adversary is not government etc (who can execute a cold boot attack anyway), it is thieves while I'm in transit, and clients around the office.)
- miles 7y ago
  Just curious; is this the Yubico guide you're referring to? macOS Logon Tool Configuration Guide https://support.yubico.com/support/solutions/articles/15000015045-macos-logon-tool-configuration-guide https://support.yubico.com/support/solutions/articles/150000... Unfortunately, it's not currently compatible with Catalina. Here are a few more resources for macOS users: Simple Daemon for lock and unlock macOS with Yubikey https://podtynnyi.com/2017/03/07/simple-daemon-for-lock-and-unlock-macos-with-yubikey/ https://podtynnyi.com/2017/03/07/simple-daemon-for-lock-and-... Locking macOS to a Yubikey 4 with PIV and PAM https://www.richard-purves.com/2017/02/13/locking-macos-with-yubikey-4-piv-and-pam/ https://www.richard-purves.com/2017/02/13/locking-macos-with... HOW to lock and unlock screen upon removal and insertion of Yubikey on macOS https://confluence.panio.info/display/PUBL/HOW+to+lock+and+unlock+screen+upon+removal+and+insertion+of+Yubikey+on+macOS https://confluence.panio.info/display/PUBL/HOW+to+lock+and+u...
  - Fnoord 7y ago
    No, that guide uses PAM and OTP. This [1] is the guide. It uses OpenSC and the smartcard feature of the YubiKey (not all support this but my YubiKey Neo (3rd gen) and YubiKey Nano 4 both do). Neither of them supports FIDO2 though; other than that they are feature rich. [1] https://support.yubico.com/support/solutions/articles/15000006468-using-your-yubikey-as-a-smart-card-in-macos https://support.yubico.com/support/solutions/articles/150000...
    - miles 7y ago
      Thanks so much for your reply, Fnoord. Does that approach allow instantly locking the screen if the YubiKey is removed? It's not mentioned in the guide, so I just want to be sure.

asia92 7y ago

Sounds like a good way to hit the 10k usb-c lifespan

dancek 7y ago
Isn't USB-C designed to wear out the cable (or dongle) and not the port? So if you used a Yubikey to log in and out ten times a day, you might need to replace it every three years. Of course you'll make the same amount of connections if you require it only for login, assuming you don't leave it connected.
Fnoord 7y ago
Lets see. Say you work 5 days a week. That's about 260 days a year (without vacations etc). Say you unlock your device 4 times a day when you work. That is 1040 times a year. Does your device even last 9-10 years? Well, if it is a MacBook, Apple ditched support for all <= 2012 MBPs. Not sure when they did, but this was true at start of last year for sure.
- fluffything 7y ago
  I have a Macbook Air 2012 which is still supported by Apple (I get new OSes and OS updates every year).
  - Fnoord 7y ago
    Try to get the screen or battery replaced. To be fair, they're easier user serviceable than newer MB(A/P)s. For example, me with my MBP 2015 will have a harder time to service it once it gets EOL (hardware-wise) than you have now with your MBA 2012.
    - fluffything 7y ago
      I've replaced the battery twice, last time in september 2019, and this last time it costed me 60 EUR, and the battery life is much better than the original one. I might want to replace the battery again in the next 3-4 years if I still have this laptop, and you might be right in that this might not be possible, but at least today it is.
      - Fnoord 7y ago
        Oh it is likely possible via iFixit or other aftermarket. Just not officially via Apple.
        fluffything 7y ago
        Yep, I just googled my model + battery, and ordered a new battery from iFixit. Took like 15 min to swap the battery myself.
- CardenB 7y ago
  I would definitely unlock my device more than four times a day. Often times my periods of focus last 30 minutes. Half the time that’s a task switch, the other half I get up to walk. This doesn’t account for meetings interrupting me.

Fnoord 7y ago

I'm using a similar setup on macOS, except mine does not use modifier keys; it just logs me out. YubiCo even provides the documentation to set it up via OpenSC. I guess you can also set macOS up to hibernate and destroy the FileVault key. (My adversary is not government etc (who can execute a cold boot attack anyway), it is thieves while I'm in transit, and clients around the office.)

miles 7y ago
Just curious; is this the Yubico guide you're referring to? macOS Logon Tool Configuration Guide https://support.yubico.com/support/solutions/articles/15000015045-macos-logon-tool-configuration-guide https://support.yubico.com/support/solutions/articles/150000... Unfortunately, it's not currently compatible with Catalina. Here are a few more resources for macOS users: Simple Daemon for lock and unlock macOS with Yubikey https://podtynnyi.com/2017/03/07/simple-daemon-for-lock-and-unlock-macos-with-yubikey/ https://podtynnyi.com/2017/03/07/simple-daemon-for-lock-and-... Locking macOS to a Yubikey 4 with PIV and PAM https://www.richard-purves.com/2017/02/13/locking-macos-with-yubikey-4-piv-and-pam/ https://www.richard-purves.com/2017/02/13/locking-macos-with... HOW to lock and unlock screen upon removal and insertion of Yubikey on macOS https://confluence.panio.info/display/PUBL/HOW+to+lock+and+unlock+screen+upon+removal+and+insertion+of+Yubikey+on+macOS https://confluence.panio.info/display/PUBL/HOW+to+lock+and+u...
- Fnoord 7y ago
  No, that guide uses PAM and OTP. This [1] is the guide. It uses OpenSC and the smartcard feature of the YubiKey (not all support this but my YubiKey Neo (3rd gen) and YubiKey Nano 4 both do). Neither of them supports FIDO2 though; other than that they are feature rich. [1] https://support.yubico.com/support/solutions/articles/15000006468-using-your-yubikey-as-a-smart-card-in-macos https://support.yubico.com/support/solutions/articles/150000...
  - miles 7y ago
    Thanks so much for your reply, Fnoord. Does that approach allow instantly locking the screen if the YubiKey is removed? It's not mentioned in the guide, so I just want to be sure.