4 ms·

Can you define what do you mean by sufficient support?

iudqnolq 4y ago
Sure: Enough support so that my life becomes sufficiently easier or more secure to be worth the cost. I know that's a bit wishy-washy, but for example I think I could replace my memorized 1password password with something longer if I never had to enter it from memory, which would only be the case if I could use the Yubikey on all my devices.
- akerl_ 4y ago
  I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That makes my email credentials radically more resistant to phishing, which is huge given that email is part of the recovery story for every other account. If those aren’t enough, I guess yubikeys aren’t the right call for your threat model, which is fine.
  - iudqnolq 4y ago
    I'd love to have that setup. The only problem is insufficiently mature support for the devices I use, Linux and Android. As I mentioned in an edit Yubikey local auth on Linux relies on a personal GitHub project abandoned years ago.
    - jklfhfyhjlo 4y ago
      Bah, everything the GP described works perfectly in Linux. Yubikey local auth isn't just one Yubikey specific project. The Yubikey implements a fuckload of open protocols, the vast majority of which work perfectly in Linux. Want local authentication? pam_u2f, pam_gpg, pam_x509 are all maintained.
    - akerl_ 4y ago
      The other person who replied to this seems to have gotten up on the wrong side of the bed, but the core of their suggestion is one I’d likewise recommend. I’m doing the yubikey local auth using the yubikey’s PIV applet, which holds standard x509 certs that can be used via pkcs11. You should be able to set up PAM to use them in that way, without needing any yubikey-specific hijinks. Something like https://discourse.ubuntu.com/t/smart-card-authentication/26009 https://discourse.ubuntu.com/t/smart-card-authentication/260...
      - iudqnolq 4y ago
        Thanks!
- yellow_postit 4y ago
  Mobile access is one of the reasons I hope a near term next gen iPhone has USB-C support directly. The lightning / usbc yubikey dongle is just too unwieldy in my experience.
  - tzmudzin 4y ago
    NFC-capable dongles work great for this.
  - oezi 4y ago
    I use Yubikey NFC and tap it to the back of a Pixel. That is a relatively nice interaction.

Sure: Enough support so that my life becomes sufficiently easier or more secure to be worth the cost. I know that's a bit wishy-washy, but for example I think I could replace my memorized 1password password with something longer if I never had to enter it from memory, which would only be the case if I could use the Yubikey on all my devices.

akerl_ 4y ago
I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That makes my email credentials radically more resistant to phishing, which is huge given that email is part of the recovery story for every other account. If those aren’t enough, I guess yubikeys aren’t the right call for your threat model, which is fine.
- iudqnolq 4y ago
  I'd love to have that setup. The only problem is insufficiently mature support for the devices I use, Linux and Android. As I mentioned in an edit Yubikey local auth on Linux relies on a personal GitHub project abandoned years ago.
  - jklfhfyhjlo 4y ago
    Bah, everything the GP described works perfectly in Linux. Yubikey local auth isn't just one Yubikey specific project. The Yubikey implements a fuckload of open protocols, the vast majority of which work perfectly in Linux. Want local authentication? pam_u2f, pam_gpg, pam_x509 are all maintained.
  - akerl_ 4y ago
    The other person who replied to this seems to have gotten up on the wrong side of the bed, but the core of their suggestion is one I’d likewise recommend. I’m doing the yubikey local auth using the yubikey’s PIV applet, which holds standard x509 certs that can be used via pkcs11. You should be able to set up PAM to use them in that way, without needing any yubikey-specific hijinks. Something like https://discourse.ubuntu.com/t/smart-card-authentication/26009 https://discourse.ubuntu.com/t/smart-card-authentication/260...
    - iudqnolq 4y ago
      Thanks!
yellow_postit 4y ago
Mobile access is one of the reasons I hope a near term next gen iPhone has USB-C support directly. The lightning / usbc yubikey dongle is just too unwieldy in my experience.
- tzmudzin 4y ago
  NFC-capable dongles work great for this.
- oezi 4y ago
  I use Yubikey NFC and tap it to the back of a Pixel. That is a relatively nice interaction.