4 ms·

No OpenPGP Smartcard support, I see. :(

by jolmg 5y ago

jordemort 5y ago
I would probably buy it if it had OpenPGP support
- jolmg 5y ago
  Me too. OpenPGP is super flexible and this would've been an upgrade to 3FA for everything I use it for.
- rkeene2 5y ago
  Most of the YubiKeys support PIV (NIST SP 800-73) mode, which gets you X.509 support (and a PKCS#11 module), which has much broader support than PGP.
  - staticassertion 5y ago
    The Bio series does not support PIV/PKCS#11 at this time afaik
nixpulvis 5y ago
What are the alternatives now? I never really liked the Yubico stuff, though I have to admit that their hardware is well made.
- jolmg 5y ago
  I don't know of a similar product that supports tap-prompts and blinking lights[1] like Yubikeys do. Yubikey 4/5 still seem to be the best, IMO. [1] https://news.ycombinator.com/item?id=28765982 https://news.ycombinator.com/item?id=28765982
- tialaramex 5y ago
  If you wanted OpenPGP to protect SSH, you should consider upgrading clients and servers to a modern OpenSSH which can just speak FIDO (which this and other recent Yubikeys support)
  - jolmg 5y ago
    I haven't used FIDO. If you lose your FIDO key, do you have the option of buying another one and making it authenticate like the original without having to inform all the servers of the change? I think the only advantage of FIDO over OpenPGP is that some web services support it. Are there other advantages?
    - staticassertion 5y ago
      > I haven't used FIDO. If you lose your FIDO key, do you have the option of buying another one and making it authenticate like the original without having to inform all the servers of the change? I think this is technically possible (some keys let you access the seed iirc, though the FIDO counter would not match) but not recommended. Instead you'd just register two keys so that if you lose one you have a backup.
    - tialaramex 5y ago
      Yes, you would need to inform all the servers of the change, a compliant FIDO authenticator shouldn't be clonable. However, if you've got a whole bunch of servers you can do SSH certificates instead of raw keys, and then you only need to go through the process once (to get the certificate) since the servers just care that your certificate was signed by the authorised CA. That definitely makes sense if you're at the "cattle not pets" level of servers where you don't care which server this is, and it can start to make sense even at the scale I grew up with where servers have themed names, so really by the time "All the servers" seems like a genuinely annoying problem, you ought to be rolling out certificates. Once upon a time I'd have argued that some of the other tricks to do centralised key auth are good, but I think on balance you should just go with certificates. FIDO is cheaper, although obviously if you already have OpenPGP you don't care about that.
      - jolmg 5y ago
        > Yes, you would need to inform all the servers of the change, a compliant FIDO authenticator shouldn't be clonable. Depends on how you define clonable, but that shouldn't be a requirement to be able to avoid having to inform servers. OpenPGP smartcards can't be cloned in the sense of being able to read the key off them, but you can write the key to them. So a key-pair can be generated outside, written to the smartcard and backed up however one considers sufficiently secure. If the smartcard is lost, one can buy another one and write the key from the backup. The old smartcard being lost is not much of a concern either, since if the password is entered incorrectly a few times, the smartcard becomes blocked. > However, if you've got a whole bunch of servers you can do SSH certificates instead of raw keys, and then you only need to go through the process once (to get the certificate) since the servers just care that your certificate was signed by the authorised CA. Not all circumstances are equal. Some servers are too old to support certificates :(, and upgrading just the ssh servers is unvalued and non-trivial (I don't know if OpenSSH still even supports the OS). Also, servers are not all under the same organization, so no unified CA. Authenticating via OpenPGP requires no server considerations. It works everywhere and is a personal decision rather than an organizational one.

No OpenPGP Smartcard support, I see. :(

by jolmg 5y ago

No OpenPGP Smartcard support, I see. :(

jordemort 5y ago

I would probably buy it if it had OpenPGP support

jolmg 5y ago
Me too. OpenPGP is super flexible and this would've been an upgrade to 3FA for everything I use it for.
rkeene2 5y ago
Most of the YubiKeys support PIV (NIST SP 800-73) mode, which gets you X.509 support (and a PKCS#11 module), which has much broader support than PGP.
- staticassertion 5y ago
  The Bio series does not support PIV/PKCS#11 at this time afaik

nixpulvis 5y ago

What are the alternatives now? I never really liked the Yubico stuff, though I have to admit that their hardware is well made.

jolmg 5y ago
I don't know of a similar product that supports tap-prompts and blinking lights[1] like Yubikeys do. Yubikey 4/5 still seem to be the best, IMO. [1] https://news.ycombinator.com/item?id=28765982 https://news.ycombinator.com/item?id=28765982
tialaramex 5y ago
If you wanted OpenPGP to protect SSH, you should consider upgrading clients and servers to a modern OpenSSH which can just speak FIDO (which this and other recent Yubikeys support)
- jolmg 5y ago
  I haven't used FIDO. If you lose your FIDO key, do you have the option of buying another one and making it authenticate like the original without having to inform all the servers of the change? I think the only advantage of FIDO over OpenPGP is that some web services support it. Are there other advantages?
  - staticassertion 5y ago
    > I haven't used FIDO. If you lose your FIDO key, do you have the option of buying another one and making it authenticate like the original without having to inform all the servers of the change? I think this is technically possible (some keys let you access the seed iirc, though the FIDO counter would not match) but not recommended. Instead you'd just register two keys so that if you lose one you have a backup.
  - tialaramex 5y ago
    Yes, you would need to inform all the servers of the change, a compliant FIDO authenticator shouldn't be clonable. However, if you've got a whole bunch of servers you can do SSH certificates instead of raw keys, and then you only need to go through the process once (to get the certificate) since the servers just care that your certificate was signed by the authorised CA. That definitely makes sense if you're at the "cattle not pets" level of servers where you don't care which server this is, and it can start to make sense even at the scale I grew up with where servers have themed names, so really by the time "All the servers" seems like a genuinely annoying problem, you ought to be rolling out certificates. Once upon a time I'd have argued that some of the other tricks to do centralised key auth are good, but I think on balance you should just go with certificates. FIDO is cheaper, although obviously if you already have OpenPGP you don't care about that.
    - jolmg 5y ago
      > Yes, you would need to inform all the servers of the change, a compliant FIDO authenticator shouldn't be clonable. Depends on how you define clonable, but that shouldn't be a requirement to be able to avoid having to inform servers. OpenPGP smartcards can't be cloned in the sense of being able to read the key off them, but you can write the key to them. So a key-pair can be generated outside, written to the smartcard and backed up however one considers sufficiently secure. If the smartcard is lost, one can buy another one and write the key from the backup. The old smartcard being lost is not much of a concern either, since if the password is entered incorrectly a few times, the smartcard becomes blocked. > However, if you've got a whole bunch of servers you can do SSH certificates instead of raw keys, and then you only need to go through the process once (to get the certificate) since the servers just care that your certificate was signed by the authorised CA. Not all circumstances are equal. Some servers are too old to support certificates :(, and upgrading just the ssh servers is unvalued and non-trivial (I don't know if OpenSSH still even supports the OS). Also, servers are not all under the same organization, so no unified CA. Authenticating via OpenPGP requires no server considerations. It works everywhere and is a personal decision rather than an organizational one.