3 ms·

ssh-keygen -t ed25519-sk and chill. https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht

by bhawks 3y ago

ssh-keygen -t ed25519-sk and chill. https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht... Can't steal keys that are in a detachable hsm.

2OEH8eoCRo0 3y ago
Spend $650 and chill? https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/ https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/
- bhawks 3y ago
  The $25 version works fine don't buy features you don't need. https://www.yubico.com/product/security-key-nfc-by-yubico-black/ https://www.yubico.com/product/security-key-nfc-by-yubico-bl...
  - 2OEH8eoCRo0 3y ago
    Oh. That's not an HSM.
    - marcus0x62 3y ago
      Yeah...Because an HSM isn't for storing ssh keys on developer machines...
- wg0 3y ago
  Why is this so expensive? Like almost the price of an upper middle class GPU or a modern gaming console (PS5 or XBox or latest SteamDeck) so what's so expensive inside it to justify that much of a price? Or it's just enormous profit seeking?
  - marcus0x62 3y ago
    It's "expensive"[0] because the product being linked to is completely different than a hardware security token used to store a credential like an ssh key. Yubikeys that can store an ssh key are like $50. 0 - the Yubi HSM is 1-2 orders of magnitude less expensive than competing HSM products.
    - wg0 3y ago
      But even then what makes them expensive? Components?
      - marcus0x62 3y ago
        Components, development cost, a small market, and profiteering. You’re talking about a hardened appliance meant to store encryption keys, sign transactions with those keys, and resist disclosure of the keys even if an attacker physically steals the device and, for instance, tries to retrieve the keys from something like an xray analysis of the chip. That’s the theory. In practice these things have been…Less than perfect. https://www.schneier.com/blog/archives/2019/06/hacking_hardwar.html https://www.schneier.com/blog/archives/2019/06/hacking_hardw...

by bhawks 3y ago

2OEH8eoCRo0 3y ago

Spend $650 and chill? https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/ https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/

bhawks 3y ago
The $25 version works fine don't buy features you don't need. https://www.yubico.com/product/security-key-nfc-by-yubico-black/ https://www.yubico.com/product/security-key-nfc-by-yubico-bl...
- 2OEH8eoCRo0 3y ago
  Oh. That's not an HSM.
  - marcus0x62 3y ago
    Yeah...Because an HSM isn't for storing ssh keys on developer machines...
wg0 3y ago
Why is this so expensive? Like almost the price of an upper middle class GPU or a modern gaming console (PS5 or XBox or latest SteamDeck) so what's so expensive inside it to justify that much of a price? Or it's just enormous profit seeking?
- marcus0x62 3y ago
  It's "expensive"[0] because the product being linked to is completely different than a hardware security token used to store a credential like an ssh key. Yubikeys that can store an ssh key are like $50. 0 - the Yubi HSM is 1-2 orders of magnitude less expensive than competing HSM products.
  - wg0 3y ago
    But even then what makes them expensive? Components?
    - marcus0x62 3y ago
      Components, development cost, a small market, and profiteering. You’re talking about a hardened appliance meant to store encryption keys, sign transactions with those keys, and resist disclosure of the keys even if an attacker physically steals the device and, for instance, tries to retrieve the keys from something like an xray analysis of the chip. That’s the theory. In practice these things have been…Less than perfect. https://www.schneier.com/blog/archives/2019/06/hacking_hardwar.html https://www.schneier.com/blog/archives/2019/06/hacking_hardw...