3 ms·

I have three Yubikeys that I use for TOTP and that house my GPG keys and SSH key. At any given time, I have one on my person, one in my home office and one off

by smoyer 5y ago

I have three Yubikeys that I use for TOTP and that house my GPG keys and SSH key. At any given time, I have one on my person, one in my home office and one off-site. I only use TOTP on the Yubikeys for "critical accounts" and use oathtool and password-store to perform TOTP for most accounts (in Firefox via passff). Password-store features git push and pull so I keep my encrypted passwords and TOTP keys on a couple remote Git servers. Because I use passwords that I don't know for every service, the Yubikeys are really more about being a safe way to back-up and transport my encryption key. If I've got that, I can always decrypt my passwords.

edent 5y ago
How do you sync the Yubikeys if they're in different locations? Like, if you're at work and sign up to a new service - how do the other two get associated? Sorry if that's an obvious question.
- smoyer 5y ago
  I do rotate which key is off-site. For the "critical sites" this means I've only got two keys registered for some period of time. I don't use the TOTP on the Yubikeys for most sites so signing up for a new service involves generating a new TOTP key with oathtool and saving that in password-store (along with the URL and login name) when I generate the password.
kdtsh 5y ago
This sounds like a neat arrangement. How do you go about this when you’re on the go? - do you have an app on your phone which support unlocking your password-store using a smart card, or do you just not manage passwords/MFA except on your computer?
- smoyer 5y ago
  Each of my phones has its own private key and can decrypt the stored passwords. Having a private key protected only by a six number passcode is obviously a weak point in my security. Since password-store is encrypting each password with seven or eight public keys, it's relatively easy to revoke a compromised key and to re-encrypt all passwords/TOTP keys (excluding the compromised key). I mostly generate passwords and add entries to my password manager from a computer but I've got all the required public keys on each device so it's theoretically possible to manipulate the password-store from a phone or tablet as well.

by smoyer 5y ago

edent 5y ago

How do you sync the Yubikeys if they're in different locations? Like, if you're at work and sign up to a new service - how do the other two get associated? Sorry if that's an obvious question.

smoyer 5y ago
I do rotate which key is off-site. For the "critical sites" this means I've only got two keys registered for some period of time. I don't use the TOTP on the Yubikeys for most sites so signing up for a new service involves generating a new TOTP key with oathtool and saving that in password-store (along with the URL and login name) when I generate the password.

kdtsh 5y ago

This sounds like a neat arrangement. How do you go about this when you’re on the go? - do you have an app on your phone which support unlocking your password-store using a smart card, or do you just not manage passwords/MFA except on your computer?

smoyer 5y ago
Each of my phones has its own private key and can decrypt the stored passwords. Having a private key protected only by a six number passcode is obviously a weak point in my security. Since password-store is encrypting each password with seven or eight public keys, it's relatively easy to revoke a compromised key and to re-encrypt all passwords/TOTP keys (excluding the compromised key). I mostly generate passwords and add entries to my password manager from a computer but I've got all the required public keys on each device so it's theoretically possible to manipulate the password-store from a phone or tablet as well.