4 ms·
sudo, screen lock, luks, ssh, pgp, weblogins, keepass are all setup with yubikeys. I wish I could generate my own private fido key in similar way as pgp.
by neatze 4y ago
sudo, screen lock, luks, ssh, pgp, weblogins, keepass are all setup with yubikeys.
I wish I could generate my own private fido key in similar way as pgp.
- account-5 4y agoThis is what I would require before migrating. Opensource local only Fido key generation. But like I said in the comment below, I suspect these vendors are only here for vendor lock-in and targeted advertising. And the websites enabling webauthn are likely to require you to use a vendors app/service. Like banking sites today not allowing me to utilise keepassxc totp functionality trying to force me to download their app or SMS.
- vladvasiliu 4y agoYes, I think it would be great to be able to create the key otuside of the physical hardware token, just like you can do with the GPG applet on the Yubkey. Store the original on some offline, encrypted media, ideally in multiple places. This way, you don't need to have two yubikeys on hand and register them both on every new site. But in case you lose, it's not impossible to create a new one. Yet, obtaining the key from the hardware token shouldn't be any more possible than with the current system.
- Godel_unicode 4y agoThese two goals are mutually exclusive. If you let people generate their own key material outside the enclave, people will be emailing it to themselves just in case.
- ilyt 4y agoWell, non-stupid people also use yubikeys, so they are not mutually exclusive
- Godel_unicode 4y agoMaybe, but there are also a lot of people who don’t understand the point of yubikeys that want to use them but export the secrets. Those people cannot be trusted with their own security and need to be protected from themselves.
- ilyt 4y agoNope, let them be burned, the sooner the better, before they own something actually valuable behind the account
- Godel_unicode 4y agoWhat a truly psychopathic take, I really hope you’re not making decisions that effect people.
- diggernet 4y agoI have the same opinion of people who want to control others because they "need to be protected from themselves".
- Godel_unicode 4y agoSo I take it you’re against food safety standards, seatbelt laws, taxes on cigarettes, the clean air act, payday loan reforms, etc. Most people will never understand this subject, and the fact that they don’t need to is a good thing. If you want a hobby, great, you can go figure out how to do that. The default needs to be safety.
- neatze 4y agoNo one mentioned exporting keys, but importing to yubikey (one way) same as it is already done with gpg on air gaped machine versus generating fido private key on reset within yubkey itself.
- cmdli 4y agoSoftware-based passkeys can do this! Bulwark Passkey (https://bulwark.id https://bulwark.id) is a virtual Yubikey-like device, and you can back up the credentials file however you like.