5 ms·

".. the biggest advantage of FIDO2 security keys is that they are cheaper and more user-friendly.". Not wrong, but also overselling how user friendly the new k

by taeric 4y ago

".. the biggest advantage of FIDO2 security keys is that they are cheaper and more user-friendly.". Not wrong, but also overselling how user friendly the new keys are. Somewhat amusingly, the yubikeys also support storing a gpg key. So, most of the old stuff still works with them.

wkat4242 4y ago
Yeah I use the GPG functionality for a lot of stuff. SSH keys, file encryption, my password manager (which is zx2c4's pass, basically using GPG file encryption). The software toolchain is anything but friendly indeed. On Android it's the easiest with Openkeychain but in Linux and Windows it's hard to get gpg running with CCID key support (USB smartcard which is what the Yubikey emulates). It's also pretty buggy, gpg's scdaemon tends to crash a lot. Technically I could move some of this stuff over to FIDO2. Like SSH logins. But I don't see the point until I can move all my usecases over, and older SSH servers don't support it, like the ones in my HP iLO boxes which I can't update. So I'd still have to keep 2 separate systems side by side which isn't worth it. So on I go but yeah it isn't for everyone. FIDO2 will make this a lot better. Eventually. Right now Firefox doesn't even support passwordless FIDO2 logins (CTAP2) on Linux or Mac, only on Windows... This really keeps me from implementing it because I use Firefox on FreeBSD and Linux. I really don't get why Mozilla doesn't prioritize this.
- pezezin 4y ago
  Have you tried the PIV mode for SSH? I found it much easier to setup than GPG mode, and it works flawlessly on Linux.
  - wkat4242 4y ago
    I have yes, but I find the PIV management tools for the card itself very poor. Also, I use PIV for work, so this way I can separate personal and work use and still use the same yubikey for both.
- vladvasiliu 4y ago
  I haven't tried using the GPG mode on mobile, but I've had absolutely 0 issues with it on Linux. Just followed the arch wiki setup and this random guide I found: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide. I use it daily to ssh into hosts and sign git commits. On Windows, it's a bit more involved, of course, especially for SSH. I seem to remember that I did find at one point some hack which allowed ssh to use the GPG agent. Since I only rarely use Windows, I didn't care enough to test it through. Code signing seems to work well enough. SmartCard emulation also works well enough, but it does seem to conflict with some other mode, either U2F or GPG, can't remember which. You have to un/replug the key to switch modes. I am also quite... surprised at Firefox's apparent lack of priority for supporting CTAP2. I've seen there are long-open bugs, but not that much interest. My understanding is that on macos and windows, it delegates the user verification to the os, and on linux there isn't anything for that. FWIW, chrome seems fine with implementing their own.
  - wkat4242 4y ago
    Thanks for the link! The main problem I have is that gpg-agent won't start in ssh-agent mode automatically. I noticed on Ubuntu that there's some scripts that check if this directive is present in ~/.gpg/gnupg-agent.conf and then start it accordingly (and not load gnome-keychain) but this is not working correctly. I spent ages messing around to get it to load. These days I use FreeBSD with KDE and it was a bit easier to get it to work. But I still have the scdaemon crashes a lot. But yeah I really wish they would finally fix CTAP2 on Linux. I think the problem is a bit chicken and egg / there's not many services actually supporting it yet. Microsoft 365 is the only one I use that has it. And there it's in 'preview' so my work doesn't allow it, on my personal instance I do have it enabled though.
    - vladvasiliu 4y ago
      Passwordless U2F is no longer in preview on Microsoft 365, at least when I look at the config through the Azure AD interface. However, the situation is actually worse than that on the MS front. Because it actually requires user verification even when used as a second factor, you cannot use such a token at all with MS's ecosystem. Which basically means that if you use Firefox on Linux, you're stuck with less secure second factors. Paradoxically, MS Edge on Linux doesn't support CTAP2, either, although it's based on Chromium, which works OK.
sebazzz 4y ago
The blue Yubikey Security Key only has WebAuthn (FIDO). The 5 series does have GPG.
- taeric 4y ago
  Ah, great point. I forgot they have basic FIDO only keys. I have mostly the NFC and micro ones. I also picked up the Google Titan keys back when, but since they are FIDO only... it greatly limited my use of them.

by taeric 4y ago

wkat4242 4y ago

Yeah I use the GPG functionality for a lot of stuff. SSH keys, file encryption, my password manager (which is zx2c4's pass, basically using GPG file encryption). The software toolchain is anything but friendly indeed. On Android it's the easiest with Openkeychain but in Linux and Windows it's hard to get gpg running with CCID key support (USB smartcard which is what the Yubikey emulates). It's also pretty buggy, gpg's scdaemon tends to crash a lot. Technically I could move some of this stuff over to FIDO2. Like SSH logins. But I don't see the point until I can move all my usecases over, and older SSH servers don't support it, like the ones in my HP iLO boxes which I can't update. So I'd still have to keep 2 separate systems side by side which isn't worth it. So on I go but yeah it isn't for everyone. FIDO2 will make this a lot better. Eventually. Right now Firefox doesn't even support passwordless FIDO2 logins (CTAP2) on Linux or Mac, only on Windows... This really keeps me from implementing it because I use Firefox on FreeBSD and Linux. I really don't get why Mozilla doesn't prioritize this.

pezezin 4y ago
Have you tried the PIV mode for SSH? I found it much easier to setup than GPG mode, and it works flawlessly on Linux.
- wkat4242 4y ago
  I have yes, but I find the PIV management tools for the card itself very poor. Also, I use PIV for work, so this way I can separate personal and work use and still use the same yubikey for both.
vladvasiliu 4y ago
I haven't tried using the GPG mode on mobile, but I've had absolutely 0 issues with it on Linux. Just followed the arch wiki setup and this random guide I found: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide. I use it daily to ssh into hosts and sign git commits. On Windows, it's a bit more involved, of course, especially for SSH. I seem to remember that I did find at one point some hack which allowed ssh to use the GPG agent. Since I only rarely use Windows, I didn't care enough to test it through. Code signing seems to work well enough. SmartCard emulation also works well enough, but it does seem to conflict with some other mode, either U2F or GPG, can't remember which. You have to un/replug the key to switch modes. I am also quite... surprised at Firefox's apparent lack of priority for supporting CTAP2. I've seen there are long-open bugs, but not that much interest. My understanding is that on macos and windows, it delegates the user verification to the os, and on linux there isn't anything for that. FWIW, chrome seems fine with implementing their own.
- wkat4242 4y ago
  Thanks for the link! The main problem I have is that gpg-agent won't start in ssh-agent mode automatically. I noticed on Ubuntu that there's some scripts that check if this directive is present in ~/.gpg/gnupg-agent.conf and then start it accordingly (and not load gnome-keychain) but this is not working correctly. I spent ages messing around to get it to load. These days I use FreeBSD with KDE and it was a bit easier to get it to work. But I still have the scdaemon crashes a lot. But yeah I really wish they would finally fix CTAP2 on Linux. I think the problem is a bit chicken and egg / there's not many services actually supporting it yet. Microsoft 365 is the only one I use that has it. And there it's in 'preview' so my work doesn't allow it, on my personal instance I do have it enabled though.
  - vladvasiliu 4y ago
    Passwordless U2F is no longer in preview on Microsoft 365, at least when I look at the config through the Azure AD interface. However, the situation is actually worse than that on the MS front. Because it actually requires user verification even when used as a second factor, you cannot use such a token at all with MS's ecosystem. Which basically means that if you use Firefox on Linux, you're stuck with less secure second factors. Paradoxically, MS Edge on Linux doesn't support CTAP2, either, although it's based on Chromium, which works OK.

sebazzz 4y ago

The blue Yubikey Security Key only has WebAuthn (FIDO). The 5 series does have GPG.

taeric 4y ago
Ah, great point. I forgot they have basic FIDO only keys. I have mostly the NFC and micro ones. I also picked up the Google Titan keys back when, but since they are FIDO only... it greatly limited my use of them.