3 ms·

I think this article just convinced me to get a Yubikey...

by C14L 7y ago

Filligree 7y ago
I attempted to use a Yubikey with GitHub, but when I tried to enable it, Windows gave me an on-screen "soft" 2F dialog instead of making any use of the device at all. Seems related to something called "Hello"? Either way, I haven't found a way to disable it. Caveat emptor.
- tialaramex 7y ago
  Because GitHub obeys the part of the spec. which says sites need to allow multiple credentials, you should still be able to get where you're going (I haven't seen this "Hello" pathway) via a circuitous route. 1. Let the Hello stuff happen, GitHub will propose that you name it, why not "Hello". 2. Tell GitHub you want to enroll another token. The system will automatically disregard "Hello" because that was already enrolled, so this time it will enroll your Yubikey or whatever other tokens. 3. (Optionally, if you don't want "Hello" e.g. because it isn't your Windows PC you just borrowed it) Tell GitHub you want to remove "Hello".
- Fnoord 7y ago
  With which browser?
  - Filligree 7y ago
    This was a while ago, so I don't quite remember. Either Chrome or Firefox.
gbmor 7y ago
Go for it. They're inexpensive, handy, and easy to set up and use. I currently use it for everything from logging in to my laptop and using sudo (via PAM) to SSH (gpg-agent) to logging in to GitHub and other sites (via U2F).
- antihero 7y ago
  I'm still very confused as to how the hell they work. Do sites need to explicitly support them? Can I just use it for 1Password? Also I am a bit of a scatterbrains so prone to losing things. What do I do if I lose my YubiKey, are there recovery options? Do you use it in addition to an authenticator app or instead of? I am really confused as to the advantages it gives.
  - gbmor 7y ago
    > Do sites need to explicitly support them? The web site will need to support FIDO U2F, yes. > Can I just use it for 1Password? I've not used 1Password, so I don't know. The Yubico site should be able to tell you if a given thing is compatible. > What do I do if I lose my YubiKey, are there recovery options? Nope. Get two of them. > Do you use it in addition to an authenticator app or instead of? Sort of both. So if a site supports the use of an authenticator app but not FIDO U2F, I use the Yubico authenticator app. When opened, it stays locked until my Yubikey is tapped against my phone.

I think this article just convinced me to get a Yubikey...

by C14L 7y ago

I think this article just convinced me to get a Yubikey...

I attempted to use a Yubikey with GitHub, but when I tried to enable it, Windows gave me an on-screen "soft" 2F dialog instead of making any use of the device at all. Seems related to something called "Hello"? Either way, I haven't found a way to disable it. Caveat emptor.

tialaramex 7y ago
Because GitHub obeys the part of the spec. which says sites need to allow multiple credentials, you should still be able to get where you're going (I haven't seen this "Hello" pathway) via a circuitous route. 1. Let the Hello stuff happen, GitHub will propose that you name it, why not "Hello". 2. Tell GitHub you want to enroll another token. The system will automatically disregard "Hello" because that was already enrolled, so this time it will enroll your Yubikey or whatever other tokens. 3. (Optionally, if you don't want "Hello" e.g. because it isn't your Windows PC you just borrowed it) Tell GitHub you want to remove "Hello".
Fnoord 7y ago
With which browser?
- Filligree 7y ago
  This was a while ago, so I don't quite remember. Either Chrome or Firefox.

gbmor 7y ago

Go for it. They're inexpensive, handy, and easy to set up and use. I currently use it for everything from logging in to my laptop and using sudo (via PAM) to SSH (gpg-agent) to logging in to GitHub and other sites (via U2F).

antihero 7y ago
I'm still very confused as to how the hell they work. Do sites need to explicitly support them? Can I just use it for 1Password? Also I am a bit of a scatterbrains so prone to losing things. What do I do if I lose my YubiKey, are there recovery options? Do you use it in addition to an authenticator app or instead of? I am really confused as to the advantages it gives.
- gbmor 7y ago
  > Do sites need to explicitly support them? The web site will need to support FIDO U2F, yes. > Can I just use it for 1Password? I've not used 1Password, so I don't know. The Yubico site should be able to tell you if a given thing is compatible. > What do I do if I lose my YubiKey, are there recovery options? Nope. Get two of them. > Do you use it in addition to an authenticator app or instead of? Sort of both. So if a site supports the use of an authenticator app but not FIDO U2F, I use the Yubico authenticator app. When opened, it stays locked until my Yubikey is tapped against my phone.