5 ms·

I use the Yubikey Neo as a smartcard + gpg for ssh private key logins[1], U2F with Google[2] accounts, and their OTP for things like LastPass[3]. I wrote some

by 2bluesc 11y ago

I use the Yubikey Neo as a smartcard + gpg for ssh private key logins[1], U2F with Google[2] accounts, and their OTP for things like LastPass[3]. I wrote some patches for KeepassX to use the Yubikey to derive the encryption key (completely offline)[4] but unfortunately the maintainer has zero interest in merging them. [1] https://www.yubico.com/2012/12/yubikey-neo-openpgp/ https://www.yubico.com/2012/12/yubikey-neo-openpgp/ [2] http://googleonlinesecurity.blogspot.com/2014/10/strengthening-2-step-verification-with.html http://googleonlinesecurity.blogspot.com/2014/10/strengtheni... [3] https://www.yubico.com/products/services-software/personalization-tools/yubikey-otp/ https://www.yubico.com/products/services-software/personaliz... [4] https://github.com/keepassx/keepassx/pull/52 https://github.com/keepassx/keepassx/pull/52 and https://news.ycombinator.com/item?id=7801131 https://news.ycombinator.com/item?id=7801131

finnn 11y ago
The GPG applet only does keys up to 2048 bits :( Other than that, this is cool and I generally really like my YubiKey Neo
- bruo 11y ago
  Maybe you will like the FST-01? It's a free hardware device that can run gnuk, which is a free software smartcard over usb implementation. While it also supports RSA 2048 by default you can upgrade it to use RSA 4096 or even Ed25519 keys with GnuPG 2.1. Both, the FST-01 and Gnuk are made by one of the GnuPG main developers, gniibe :) I suggest this as I discarded a Yubikey NEO for one of these and i'm pretty happy. http://www.seeedstudio.com/wiki/FST-01 http://www.seeedstudio.com/wiki/FST-01 http://www.fsij.org/doc-gnuk/ http://www.fsij.org/doc-gnuk/
  - beagle3 11y ago
    Yubikey is FIPS-140 certified -- unfortunately, I haven't found anything else usable and/or reasonably priced that is, and the only other usable thing that's actually a smartcard, in the sense that in the absence of bugs you need some very unavailable hardware like a FIB machine, is the PGPcard.
    - bruo 11y ago
      I didn't notice any difference in the usability of Gnuk and the Yubikey NEO. I mean, i had to do the same things for both to configure and use them as they are both are "smartcards". What issues did you found with Gnuk? I'm interested as for our local work (activism related) Gnuk showed up as the best alternative for price, openess and the possibility if something fails to not have to buy new hardware. Yubikey did the right thing with their latest "put your yubikey in the trash bug" giving a new one, but we don't live in the US and time can be a factor. But still, Gnuk is far from perfect and the better it gets the better for us. Can you tell me about the issues you had so i can talk with gniibe to see if there are solutions for them? Thanks in advance.
      - beagle3 11y ago
        I didn't try gnuk - This is the first time I hear about it. I was comparing NEO to other tokens I've seen and used - it's not worse, but non of them are as simple as I would like (and no, I don't know how to describe the simplicity I'm after). Looks like the gnuk is a software implementation - do you trust it not to disclose the private key if it is physically accessible? If you do, why? I trust the NEO to require more than what your average hacker can use at home - though, of course, I don't trust it against state actors, who probably have the fund and equipment to make any smart card apparatus "talk".
rhinoceraptor 11y ago
Is it possible to sit down on someone else's computer and trivially use a Yubikey for SSH and git with SSH keys?
hobarrera 11y ago
I'm quite curious, what's the contingency plan in case the Yubikey gets stolen? How do you deal with things like email encrypted to the key you've now lost?

by 2bluesc 11y ago

finnn 11y ago

The GPG applet only does keys up to 2048 bits :( Other than that, this is cool and I generally really like my YubiKey Neo

bruo 11y ago
Maybe you will like the FST-01? It's a free hardware device that can run gnuk, which is a free software smartcard over usb implementation. While it also supports RSA 2048 by default you can upgrade it to use RSA 4096 or even Ed25519 keys with GnuPG 2.1. Both, the FST-01 and Gnuk are made by one of the GnuPG main developers, gniibe :) I suggest this as I discarded a Yubikey NEO for one of these and i'm pretty happy. http://www.seeedstudio.com/wiki/FST-01 http://www.seeedstudio.com/wiki/FST-01 http://www.fsij.org/doc-gnuk/ http://www.fsij.org/doc-gnuk/
- beagle3 11y ago
  Yubikey is FIPS-140 certified -- unfortunately, I haven't found anything else usable and/or reasonably priced that is, and the only other usable thing that's actually a smartcard, in the sense that in the absence of bugs you need some very unavailable hardware like a FIB machine, is the PGPcard.
  - bruo 11y ago
    I didn't notice any difference in the usability of Gnuk and the Yubikey NEO. I mean, i had to do the same things for both to configure and use them as they are both are "smartcards". What issues did you found with Gnuk? I'm interested as for our local work (activism related) Gnuk showed up as the best alternative for price, openess and the possibility if something fails to not have to buy new hardware. Yubikey did the right thing with their latest "put your yubikey in the trash bug" giving a new one, but we don't live in the US and time can be a factor. But still, Gnuk is far from perfect and the better it gets the better for us. Can you tell me about the issues you had so i can talk with gniibe to see if there are solutions for them? Thanks in advance.
    - beagle3 11y ago
      I didn't try gnuk - This is the first time I hear about it. I was comparing NEO to other tokens I've seen and used - it's not worse, but non of them are as simple as I would like (and no, I don't know how to describe the simplicity I'm after). Looks like the gnuk is a software implementation - do you trust it not to disclose the private key if it is physically accessible? If you do, why? I trust the NEO to require more than what your average hacker can use at home - though, of course, I don't trust it against state actors, who probably have the fund and equipment to make any smart card apparatus "talk".

rhinoceraptor 11y ago

Is it possible to sit down on someone else's computer and trivially use a Yubikey for SSH and git with SSH keys?

hobarrera 11y ago

I'm quite curious, what's the contingency plan in case the Yubikey gets stolen? How do you deal with things like email encrypted to the key you've now lost?