3 ms·

As a Yubikey user, what stops me from considering this or the Librem key is the lack of confirmation button / touch sensor (and LED).

by jolmg 6y ago

jzig 6y ago
Yeah, same.
- cycomanic 6y ago
  It does not have a button but still a touch sensor, so you have to touch the key to confirm (at least i have to for mine)
  - cycomanic 6y ago
    Sorry I should clarify that applies to the fido (not sure about the others)
    - jolmg 6y ago
      The touch sensor also works for the OpenPGP smartcard.
malandrew 6y ago
I do wish the Yubikey had a slider like the webcam covers so you could prevent accidentally pressing the button. ccccccidufjlndefkacuknijintbntjnkdnrrtncrkfi
- jolmg 6y ago
  Maybe you have the nano? I can't imagine touching the Yubikey 4's touch sensor by accident. In fact, I can't imagine my hand touching USB devices by accident.
  - Izkata 6y ago
    I got one earlier this year when they upgraded my work laptop, and found out that was a button when I pressed it accidentally while removing it - got the whatever-it-is dumped into a random terminal that happened to be in focus. Didn't hear what version it was, but it looks like a Yubikey 4.
    - jolmg 6y ago
      In your case, though, you didn't know that it was a button. Now that you know, I doubt you'll press it again by accident, since there's a lot area around it to avoid the button. > got the whatever-it-is dumped into a random terminal I don't use that feature, but I believe it can be configured to either be an OTP or a fixed password. Looking it up, if you or malandrew don't use it, you can disable it by deleting the OTP programming that comes in slot 1 by default: ykman otp delete 1
- oh_sigh 6y ago
  You could plug it into a USB cable with a built in switch which disconnects power/data.
- DenseComet 6y ago
  If you don't use the Yubico based 2fa, you can completely disable it and prevent the string output. Nowadays, most sites are using Webauthn/U2F and that will continue to work if you disable Yubico's proprietary 2fa implementation.
- mprovost 6y ago
  I always install yubiswitch [0] to prevent accidental yubisneezes. It lets you disable it from the Mac menu bar until you need it. [0] https://github.com/pallotron/yubiswitch https://github.com/pallotron/yubiswitch
- valenciarose 6y ago
  You can move OTP generation to slot 2. This prevents accidental triggering by requiring a much longer press. https://support.yubico.com/support/solutions/articles/15000006461-swapping-yubico-otp-from-slot-1-to-slot-2 https://support.yubico.com/support/solutions/articles/150000...
- sedatk 6y ago
  If you don't use OTP, I definitely recommend turning it off as it contains your YubiKey serial number and can be used to identify you. https://medium.com/hackernoon/avoid-leaking-your-identity-with-yubikey-92539b6608a https://medium.com/hackernoon/avoid-leaking-your-identity-wi...
detritus 6y ago
I've been meaning to check these out for a while as I'm totally useless (although, in security terms my chaos probably means I'm securer... just not conveniently-so) with password organisation. I more mean all the second tier shit I could barely care less about, but have to manage across multiple machines. I also remembered that if I subscribe to ArsTechnica, they give you a 'free' key for your $50 subscription. Not bad when the keys cost $45! Anyway, thanks for the prod! (I'm not in any way affiliated with Ars or CondéNast - I don't benefit from mentioning their offer here - I'm just a reader and your prompt made everything fall into place!)

As a Yubikey user, what stops me from considering this or the Librem key is the lack of confirmation button / touch sensor (and LED).

by jolmg 6y ago

As a Yubikey user, what stops me from considering this or the Librem key is the lack of confirmation button / touch sensor (and LED).

jzig 6y ago

Yeah, same.

cycomanic 6y ago
It does not have a button but still a touch sensor, so you have to touch the key to confirm (at least i have to for mine)
- cycomanic 6y ago
  Sorry I should clarify that applies to the fido (not sure about the others)
  - jolmg 6y ago
    The touch sensor also works for the OpenPGP smartcard.

malandrew 6y ago

I do wish the Yubikey had a slider like the webcam covers so you could prevent accidentally pressing the button. ccccccidufjlndefkacuknijintbntjnkdnrrtncrkfi

jolmg 6y ago
Maybe you have the nano? I can't imagine touching the Yubikey 4's touch sensor by accident. In fact, I can't imagine my hand touching USB devices by accident.
- Izkata 6y ago
  I got one earlier this year when they upgraded my work laptop, and found out that was a button when I pressed it accidentally while removing it - got the whatever-it-is dumped into a random terminal that happened to be in focus. Didn't hear what version it was, but it looks like a Yubikey 4.
  - jolmg 6y ago
    In your case, though, you didn't know that it was a button. Now that you know, I doubt you'll press it again by accident, since there's a lot area around it to avoid the button. > got the whatever-it-is dumped into a random terminal I don't use that feature, but I believe it can be configured to either be an OTP or a fixed password. Looking it up, if you or malandrew don't use it, you can disable it by deleting the OTP programming that comes in slot 1 by default: ykman otp delete 1
oh_sigh 6y ago
You could plug it into a USB cable with a built in switch which disconnects power/data.
DenseComet 6y ago
If you don't use the Yubico based 2fa, you can completely disable it and prevent the string output. Nowadays, most sites are using Webauthn/U2F and that will continue to work if you disable Yubico's proprietary 2fa implementation.
mprovost 6y ago
I always install yubiswitch [0] to prevent accidental yubisneezes. It lets you disable it from the Mac menu bar until you need it. [0] https://github.com/pallotron/yubiswitch https://github.com/pallotron/yubiswitch
valenciarose 6y ago
You can move OTP generation to slot 2. This prevents accidental triggering by requiring a much longer press. https://support.yubico.com/support/solutions/articles/15000006461-swapping-yubico-otp-from-slot-1-to-slot-2 https://support.yubico.com/support/solutions/articles/150000...
sedatk 6y ago
If you don't use OTP, I definitely recommend turning it off as it contains your YubiKey serial number and can be used to identify you. https://medium.com/hackernoon/avoid-leaking-your-identity-with-yubikey-92539b6608a https://medium.com/hackernoon/avoid-leaking-your-identity-wi...

detritus 6y ago

I've been meaning to check these out for a while as I'm totally useless (although, in security terms my chaos probably means I'm securer... just not conveniently-so) with password organisation. I more mean all the second tier shit I could barely care less about, but have to manage across multiple machines. I also remembered that if I subscribe to ArsTechnica, they give you a 'free' key for your $50 subscription. Not bad when the keys cost $45! Anyway, thanks for the prod! (I'm not in any way affiliated with Ars or CondéNast - I don't benefit from mentioning their offer here - I'm just a reader and your prompt made everything fall into place!)