3 ms·

Even I have and I use a Yubikey 5, the whole thing still feels a bit like a black box for me. I still have not found a good overview about the different standar

Even I have and I use a Yubikey 5, the whole thing still feels a bit like a black box for me. I still have not found a good overview about the different standarts, what do they different and about the many options in the Yubikey software. Also I kind of get, you can't make a backup key. But in the end, if they key is lost, you use also mostly just another password again. But for me, I would much prefer to create a second key somehow.

deadbunny 5y ago
You can create a key and load it into the Yubikey (and thus backup the key) rather than have the yubikey create the key on itself directly.
- tialaramex 5y ago
  You can't do this with the key underlying FIDO (thus U2F/ WebAuthn and the SSH feature the linked article is discussing) Yubico supply a tool that lets you perform a "factory reset" giving you a random key (effectively: instantly invalidating all credentials you previously used) but not one that would let you pick the key. IIRC The relevant standard is clear that manufacturers should not offer this capability as it's obvious how it would get exploited.
loulouxiv 5y ago
I felt the same at first when I received mine. And since the information is quite scattered in Yubico's documentation, blog and on external websites it was very time consuming to figure everything out... It also seems that a lot of things have evolved in this area so it is not easy to know what is still useful/the best way to do things. When I get the time to, I want to put up a webpage that explains the main state-of-the-art usages of the Yubikey, with step by step instructions for the major platforms
- 3np 5y ago
  * encouragement to post it on HN *
- _trampeltier 5y ago
  Would love to see such a website. Yubikey has for most platforms step for step instructions. But I really miss real documentaion, what does happen in the background. What standards do exist, why, etc.

deadbunny 5y ago

You can create a key and load it into the Yubikey (and thus backup the key) rather than have the yubikey create the key on itself directly.

tialaramex 5y ago
You can't do this with the key underlying FIDO (thus U2F/ WebAuthn and the SSH feature the linked article is discussing) Yubico supply a tool that lets you perform a "factory reset" giving you a random key (effectively: instantly invalidating all credentials you previously used) but not one that would let you pick the key. IIRC The relevant standard is clear that manufacturers should not offer this capability as it's obvious how it would get exploited.

loulouxiv 5y ago

I felt the same at first when I received mine. And since the information is quite scattered in Yubico's documentation, blog and on external websites it was very time consuming to figure everything out... It also seems that a lot of things have evolved in this area so it is not easy to know what is still useful/the best way to do things. When I get the time to, I want to put up a webpage that explains the main state-of-the-art usages of the Yubikey, with step by step instructions for the major platforms

3np 5y ago
* encouragement to post it on HN *
_trampeltier 5y ago
Would love to see such a website. Yubikey has for most platforms step for step instructions. But I really miss real documentaion, what does happen in the background. What standards do exist, why, etc.