5 ms·

No FIDO2 so it won't work with everything. No NFC.

StavrosK 6y ago
Oh, it's just U2F? You want FIDO2 with resident key support to get the really nice OpenSSH workflow (plug the key in to a new computer, run ssh-add -k, now you can SSH to all your computers).
- alias_neo 6y ago
  Can I do this with a Yubikey? Last time I tried there were a few, more complex commands than this. Could I use a udev rule to add my SSH keys as the device is plugged so I don't have to run anything? I think I was using PIV last time.
  - StavrosK 6y ago
    Yes you can, SSH 8.3ish uses FIDO2 and doesn't do anything Yubikey-specific. That means you don't have to bother with all the agent stuff, and it works with any dirt-cheap FIDO2 key. EDIT: I'm going to post a writeup tomorrow detailing how to do this, because it's wonderful and super secure.
    - alias_neo 6y ago
      Thanks, going to look into it more tonight, see if I can get a 5C setup.
      - StavrosK 6y ago
        It is literally just the two commands, I can send them to you when I'm at the pc. I have a 5C too.
        alias_neo 6y ago
        That'd be great, thanks. I'll have to do a follow up to my blog post: [SSH 2-Factor's First Factor](https://2byt.es/post/totp2/ https://2byt.es/post/totp2/) once I've had a play.
    - ta17711771 6y ago
      Have Nitro keys on the way. Looking forward to your writeup, mate.
      - StavrosK 6y ago
        It is here! https://news.ycombinator.com/item?id=23689499 https://news.ycombinator.com/item?id=23689499
  - tialaramex 6y ago
    Yes, any vaguely modern YubiKey implemented FIDO2 which is what you need. However you need fairly modern OpenSSH (this year) for both clients and servers. Both need to be upgraded because the authentication protocol itself is different, so an older server has no idea how to authenticate with FIDO2. To get the behaviour the parent describes you must make sure to follow the instructions for resident keys, and these instructions won't work on cheaper FIDO (not FIDO2) devices that designed be used as second factors. Without resident keys the authenticator only works when at the computer you used to enrol it, which is fine for a personal workstation/ laptop but not great if you need to roam.
    - alias_neo 6y ago
      Thanks, I have a few 5C's so they should be new enough, I'll need to check my laptop/desktop to make sure SSH is new enough (I run Ubuntu 20.04/Manjaro respectively). My servers most likely aren't, but I run most of my workloads in Docker or Kubernetes so it's just a matter of time to get them all updated.
    - StavrosK 6y ago
      Not strictly true, you can copy the "private" key (just a pairing file for the dongle) around and still use the USB key fine with it.
gruez 6y ago
What are some use cases where you must use FIDO2? A sibling comment mentioned SSH authentication, but what about websites?
- tialaramex 6y ago
  FIDO2 enables resident keys. With resident keys the web site can have a flow where you just go "It's me" (maybe you enter a PIN, or touch a fingerprint sensor, Apple just announced they're doing this with FaceID) and you're signed in. Without a resident key, there's a back and forth where you give a username, then maybe a password, and then your authenticator comes in to provide a second factor. This is because the FIDO2 device actually has (finite) slots to remember e.g. credentials for funky-jokes.example so when you're at funky-jokes.example a WebAuthn API call can ask for those credentials and sign you in. No username, no password, you've presented all the credentials needed in one step. Whereas when keys are not resident the authenticator is relying on the web site to know (from your username) its ID, without being told the ID it can't do the authentication dance, so you will need to enter a username/ email address. Resident keys are clearly a great idea in a phone (iPhone, Pixel, whatever) because it's not like gigabytes of flash storage will be exhausted storing credentials for the dozens or even thousands of sites you have credentials for. It's less obviously a great idea for a Yubikey or cheap USB Security Key that maybe only has space for a dozen credentials. Maybe it makes sense to use it for that one web site you sign into every day, or to replace the main SSH key you use but if a Yubikey has 25 slots it doesn't make much sense for one to be "bush-jokes.example" which you last visited ten years ago...
  - donmcronald 6y ago
    That sounds worse to me. I don't like the idea of having my identity tied to a device. What if I lose it? My favorite setup right now is to keep my username / password in a password manager that I sync to multiple places to ensure it doesn't get lost. Then I use a YubiKey with FIDO / U2F on sites I consider important. I have a main and a spare YubiKey and both get added to my profile (except AWS who only support one key).
    - 6y ago
rlpb 6y ago
According to https://hypersecu.com/tmp/downloads/files/datasheets/HSTE-NB0034-RV1.3-DSHYF-FIDOU2F-K8.pdf https://hypersecu.com/tmp/downloads/files/datasheets/HSTE-NB... it does support FIDO2.
- ChrisSD 6y ago
  That's the PRO version. As flipbrad said, it doesn't appear to be available yet. At least I can't find how to purchase one.
  - rlpb 6y ago
    There are some available here (in the UK): https://www.amazon.co.uk/gp/product/B0813YWZB2 https://www.amazon.co.uk/gp/product/B0813YWZB2
flipbrad 6y ago
Looks like they have a FIDO2 "Pro" version coming soon: https://www.amazon.co.uk/HYPERFIDO-MINI-FIDO2-HOTP-Security/dp/B0813YWZB2/ https://www.amazon.co.uk/HYPERFIDO-MINI-FIDO2-HOTP-Security/...

Oh, it's just U2F? You want FIDO2 with resident key support to get the really nice OpenSSH workflow (plug the key in to a new computer, run ssh-add -k, now you can SSH to all your computers).

alias_neo 6y ago
Can I do this with a Yubikey? Last time I tried there were a few, more complex commands than this. Could I use a udev rule to add my SSH keys as the device is plugged so I don't have to run anything? I think I was using PIV last time.
- StavrosK 6y ago
  Yes you can, SSH 8.3ish uses FIDO2 and doesn't do anything Yubikey-specific. That means you don't have to bother with all the agent stuff, and it works with any dirt-cheap FIDO2 key. EDIT: I'm going to post a writeup tomorrow detailing how to do this, because it's wonderful and super secure.
  - alias_neo 6y ago
    Thanks, going to look into it more tonight, see if I can get a 5C setup.
    - StavrosK 6y ago
      It is literally just the two commands, I can send them to you when I'm at the pc. I have a 5C too.
      - alias_neo 6y ago
        That'd be great, thanks. I'll have to do a follow up to my blog post: [SSH 2-Factor's First Factor](https://2byt.es/post/totp2/ https://2byt.es/post/totp2/) once I've had a play.
  - ta17711771 6y ago
    Have Nitro keys on the way. Looking forward to your writeup, mate.
    - StavrosK 6y ago
      It is here! https://news.ycombinator.com/item?id=23689499 https://news.ycombinator.com/item?id=23689499
- tialaramex 6y ago
  Yes, any vaguely modern YubiKey implemented FIDO2 which is what you need. However you need fairly modern OpenSSH (this year) for both clients and servers. Both need to be upgraded because the authentication protocol itself is different, so an older server has no idea how to authenticate with FIDO2. To get the behaviour the parent describes you must make sure to follow the instructions for resident keys, and these instructions won't work on cheaper FIDO (not FIDO2) devices that designed be used as second factors. Without resident keys the authenticator only works when at the computer you used to enrol it, which is fine for a personal workstation/ laptop but not great if you need to roam.
  - alias_neo 6y ago
    Thanks, I have a few 5C's so they should be new enough, I'll need to check my laptop/desktop to make sure SSH is new enough (I run Ubuntu 20.04/Manjaro respectively). My servers most likely aren't, but I run most of my workloads in Docker or Kubernetes so it's just a matter of time to get them all updated.
  - StavrosK 6y ago
    Not strictly true, you can copy the "private" key (just a pairing file for the dongle) around and still use the USB key fine with it.

gruez 6y ago

What are some use cases where you must use FIDO2? A sibling comment mentioned SSH authentication, but what about websites?

tialaramex 6y ago
FIDO2 enables resident keys. With resident keys the web site can have a flow where you just go "It's me" (maybe you enter a PIN, or touch a fingerprint sensor, Apple just announced they're doing this with FaceID) and you're signed in. Without a resident key, there's a back and forth where you give a username, then maybe a password, and then your authenticator comes in to provide a second factor. This is because the FIDO2 device actually has (finite) slots to remember e.g. credentials for funky-jokes.example so when you're at funky-jokes.example a WebAuthn API call can ask for those credentials and sign you in. No username, no password, you've presented all the credentials needed in one step. Whereas when keys are not resident the authenticator is relying on the web site to know (from your username) its ID, without being told the ID it can't do the authentication dance, so you will need to enter a username/ email address. Resident keys are clearly a great idea in a phone (iPhone, Pixel, whatever) because it's not like gigabytes of flash storage will be exhausted storing credentials for the dozens or even thousands of sites you have credentials for. It's less obviously a great idea for a Yubikey or cheap USB Security Key that maybe only has space for a dozen credentials. Maybe it makes sense to use it for that one web site you sign into every day, or to replace the main SSH key you use but if a Yubikey has 25 slots it doesn't make much sense for one to be "bush-jokes.example" which you last visited ten years ago...
- donmcronald 6y ago
  That sounds worse to me. I don't like the idea of having my identity tied to a device. What if I lose it? My favorite setup right now is to keep my username / password in a password manager that I sync to multiple places to ensure it doesn't get lost. Then I use a YubiKey with FIDO / U2F on sites I consider important. I have a main and a spare YubiKey and both get added to my profile (except AWS who only support one key).
  - 6y ago

rlpb 6y ago

According to https://hypersecu.com/tmp/downloads/files/datasheets/HSTE-NB0034-RV1.3-DSHYF-FIDOU2F-K8.pdf https://hypersecu.com/tmp/downloads/files/datasheets/HSTE-NB... it does support FIDO2.

ChrisSD 6y ago
That's the PRO version. As flipbrad said, it doesn't appear to be available yet. At least I can't find how to purchase one.
- rlpb 6y ago
  There are some available here (in the UK): https://www.amazon.co.uk/gp/product/B0813YWZB2 https://www.amazon.co.uk/gp/product/B0813YWZB2

flipbrad 6y ago

Looks like they have a FIDO2 "Pro" version coming soon: https://www.amazon.co.uk/HYPERFIDO-MINI-FIDO2-HOTP-Security/dp/B0813YWZB2/ https://www.amazon.co.uk/HYPERFIDO-MINI-FIDO2-HOTP-Security/...