4 ms·

Sounds like a good option. I've been finding it hard to understand how this all fits together. For example, which of the standards listed above is the mechanism

Sounds like a good option. I've been finding it hard to understand how this all fits together. For example, which of the standards listed above is the mechanism used to unlock a PC or a mac? Which one applies to allowing sudo? I guess that's the crux of it. I'd prefer to find an open hardware alternative if possible, and not have to trust additional software. I know my use case, but don't know which standards apply and are required to make it happen. Knowing that would allow me to pick an open hardware key that, by meeting those standards, would let me do what I need. It just seems even ticking those boxes isn't much of a guarantee when so much extra software appears to be needed. The alternative is to either find: - the open device with the most active developer community and hope the feature comes - the device that just meets the most standards (as you suggest, a Yubikey) If I sound confused it's just because I am.

tialaramex 5y ago
For your "Unlock a PC" need you may be looking for the FIDO optional feature hmac-secret. e.g. one of the things Microsoft wants to unlock a (potentially offline) Windows 10 PC is hmac-secret and it is not an essential feature of FIDO since you wouldn't need it to e.g. sign in to Google, or GitHub or whatever. For products built by the community, you should be able to find someone who has tried your scenario (e.g. "Unlock a macOS 12 macBook") and can say it definitely works with the product before you buy one.
- Sporktacular 5y ago
  That (a feature name) is what I'm talking about. Thanks a lot. I guess another I noticed was PIV/Smartcard which seems to be kind of long in the tooth and not available on some newer hardware keys. I'm not sure if that's for security reasons and I start to wonder if multi-protocol hardware is more open to a wider array of attacks. But thanks again.
mlac 5y ago
It’s not easy and there may be a solution out there that I’m not aware of, but yubico met my needs (and Feitan) so I stopped. The principle I keep in mind here is that the implementation is the weakest part of crypto and has the most room for error. For me personally, it requires too much time and energy to roll my own, especially knowing I’ll likely screw something up. If it was a side project, slightly different, but I want something I can forget about for a year and come back and it just works. In my case, the risk of an overly complicated setup locking me out is higher than any risk from using yubicos hardware and setting things up. But I would start with getting a key, playing around, and doing what they other commenter suggested.
- Sporktacular 5y ago
  It's good advice. I got a solo key but found it difficult getting into a useful state for my needs. Might try a Yubi instead. Cheers.

tialaramex 5y ago

For your "Unlock a PC" need you may be looking for the FIDO optional feature hmac-secret. e.g. one of the things Microsoft wants to unlock a (potentially offline) Windows 10 PC is hmac-secret and it is not an essential feature of FIDO since you wouldn't need it to e.g. sign in to Google, or GitHub or whatever. For products built by the community, you should be able to find someone who has tried your scenario (e.g. "Unlock a macOS 12 macBook") and can say it definitely works with the product before you buy one.

Sporktacular 5y ago
That (a feature name) is what I'm talking about. Thanks a lot. I guess another I noticed was PIV/Smartcard which seems to be kind of long in the tooth and not available on some newer hardware keys. I'm not sure if that's for security reasons and I start to wonder if multi-protocol hardware is more open to a wider array of attacks. But thanks again.

mlac 5y ago

It’s not easy and there may be a solution out there that I’m not aware of, but yubico met my needs (and Feitan) so I stopped. The principle I keep in mind here is that the implementation is the weakest part of crypto and has the most room for error. For me personally, it requires too much time and energy to roll my own, especially knowing I’ll likely screw something up. If it was a side project, slightly different, but I want something I can forget about for a year and come back and it just works. In my case, the risk of an overly complicated setup locking me out is higher than any risk from using yubicos hardware and setting things up. But I would start with getting a key, playing around, and doing what they other commenter suggested.

Sporktacular 5y ago
It's good advice. I got a solo key but found it difficult getting into a useful state for my needs. Might try a Yubi instead. Cheers.