12 ms·

What gmac said, though his headline could have been better :) We call them V-Keys instead of Yubikeys, because the latter would imply you can use them on any Yu

by mattbee 15y ago

What gmac said, though his headline could have been better :) We call them V-Keys instead of Yubikeys, because the latter would imply you can use them on any Yubikey-supporting site. And with ours, you won't be able to.

gmac 15y ago
Yes, I traded accuracy for recognisability, but I was struggling a bit to work out BigV's #1 USP for HNers. Maybe you could think about that a bit for the front page. To me, "Servers that grow" doesn't immediately distinguish you from Linode et al. -- even if the claim is true to an impressive extent when I read on. (Also -- hi Matt! We should catch up if you're ever in London.)
corin_ 15y ago
It's a while since I was looking into how they work and my memory is a bit foggy, is there no way to configure them in such a way that they could work for your services and for my own, but without using the official central server? For example, I use it for SSH authentication, if I had a server with you it would be nice if I didn't need one key to access the control system, and a different one for SSH.
- mattbee 15y ago
  The security of Yubikeys (and RSA tokens, and most other two-factor authentication devices) rely on a shared secret between the authentication server and the devices themselves. If you wanted to authenticate your own VMs with your V-Key, we'd need to either share the programming secret with our customers, or provide an authentication service that we pre-configure the VMs to back onto. The former would compromise the security of the keys. The latter is a possibility, but not a high-priority one at the moment :) The keys do have a second authentication slot into which you can program your own fixed password, or another two-factor secret from which you can do your own auth on your own server (to use the second configuration you hold the button for about 4-5 seconds so it's not as convenient).
  - corin_ 15y ago
    Perhaps you might some day be able to put your configuration in the second slot? (Again I'd assume, not exactly a priority.) Since I'd expect to be logging into my own stuff (e.g. servers) far more often than the control panel for those servers. Anyway, looks great overall, will certainly be trying it out as soon as I can, see if a switch from Linode is required :)

by mattbee 15y ago

gmac 15y ago

Yes, I traded accuracy for recognisability, but I was struggling a bit to work out BigV's #1 USP for HNers. Maybe you could think about that a bit for the front page. To me, "Servers that grow" doesn't immediately distinguish you from Linode et al. -- even if the claim is true to an impressive extent when I read on. (Also -- hi Matt! We should catch up if you're ever in London.)

corin_ 15y ago

It's a while since I was looking into how they work and my memory is a bit foggy, is there no way to configure them in such a way that they could work for your services and for my own, but without using the official central server? For example, I use it for SSH authentication, if I had a server with you it would be nice if I didn't need one key to access the control system, and a different one for SSH.

mattbee 15y ago
The security of Yubikeys (and RSA tokens, and most other two-factor authentication devices) rely on a shared secret between the authentication server and the devices themselves. If you wanted to authenticate your own VMs with your V-Key, we'd need to either share the programming secret with our customers, or provide an authentication service that we pre-configure the VMs to back onto. The former would compromise the security of the keys. The latter is a possibility, but not a high-priority one at the moment :) The keys do have a second authentication slot into which you can program your own fixed password, or another two-factor secret from which you can do your own auth on your own server (to use the second configuration you hold the button for about 4-5 seconds so it's not as convenient).
- corin_ 15y ago
  Perhaps you might some day be able to put your configuration in the second slot? (Again I'd assume, not exactly a priority.) Since I'd expect to be logging into my own stuff (e.g. servers) far more often than the control panel for those servers. Anyway, looks great overall, will certainly be trying it out as soon as I can, see if a switch from Linode is required :)