Leace

27 ms·

1. 211.▲
   by Leace 8y ago

   Yubikey has a lot of features (applets) built-in so the answer is "it depends on what you use". U2F? You need to have a second one or backup codes. OpenPGP? You probably have your subkeys backed up somewhere so you just order a ne
2. 212.▲
   by Leace 8y ago

   > FIDO2 can be used as a replacement for a username/password, so you can go to a site, insert your FIDO2 key and log in without any other information. Technically U2F can be used to design passwordless scheme too (returning a big ar
3. 213.▲
   by Leace 8y ago

   5 is like a merger of NEO and 4, NEO has NFC and 4 has 4096 RSA keys. And then there is FIDO2 but until it's in widespread usage U2F works fine.
4. 214.▲
   by Leace 8y ago

   Wow, this looks really cool. Yubikey 4 lacked NFC support so with 5 it's easy to use the same key via USB-A (laptop) and NFC (via OpenKeychain on Android). It appears that RSA 4096 keys can be used via NFC, no other NFC-capable keys ha
5. 215.▲
   by Leace 8y ago

   I had contact with Posteo support and can confirm they are very helpful.
6. 216.▲
   by Leace 8y ago

   Actually K-9 already has a nice UI in "master" branch but for some unknown reasons it's not released yet :(
7. 217.▲
   by Leace 8y ago

   > Has anyone been able to log in using a Yubikey and Firefox to Google? Because I haven't. Yes, this works ever since Google introduced new accounts page. Tested with Firefox on Windows and Linux.
8. 218.▲
   by Leace 8y ago

   Isn't using U2F+SSH CA's just moving the challenge-response protocol one level up? U2F is "just" a hardware P-256 key (or a set of keys unique to origin, but ignoring privacy issues they are comparable, of course I'
9. 219.▲
   by Leace 8y ago

   > ... Y4 does U2F along with the smard card RSA stuff. PIV applet also supports P-256: https://developers.yubico.com/PIV/Introduction/YubiKey_and_P... > ... for every time I use the smart card RSA stuff (for
10. 220.▲
    by Leace 8y ago

    For the record GnuPG supports ed25519 keys for some time so there is no need to use RSA.
11. 221.▲
    by Leace 8y ago

    > The notaries can then add a record on the block chain saying roughly "I do notarization act X on document Y" (It'll be the equivalent of what they enter in their log books today and there will be some corresponding stamp
12. 222.▲
    by Leace 8y ago

    > (...) Github has no chance to insert or modify code. Yes, exactly! The only slim window is refs. All-signed-commits still does not protect against someone pushing signed commit from branch "testing" to branch "master&quo
13. 223.▲
    by Leace 8y ago

    Signed git pushes give you an opportunity to check if they really were "committed by someone with the right to do so". Without git push --signed you have to basically trust Github (which may be fine for most people's needs).
14. 224.▲
    by Leace 8y ago

    Github lowers barriers to entry for a lot of people and I guess Mozilla likes that. Compare creating a one line fix for a project on github and having a discussion and review to sending a properly formatted patch to a mailing list and follo
15. 225.▲
    by Leace 8y ago

    > There are also efforts like DANE to put it in DNS. It seems GnuPG and "the ecosystem" is slowly moving to WKD (Web Key Directory) as it is easier to deploy (e.g. kernel.org is using it). If you put your binary key (gpg --expo
16. 226.▲
    by Leace 8y ago

    I wouldn't have an issue with that if it was a private subkey. You could easily revoke it and replace it in case Keybase does something weird. But giving them private keys for master/primary key is not exactly sensible. For the re
17. 227.▲
    by Leace 8y ago

    This description perfectly captures my impression on Keybase too (especially the part on unwillingness to decentralize their social-media based identities). For the record it soon may be possible to use native GnuPG through the browser exte
18. 228.▲
    by Leace 8y ago

    When they started asking me for my private key and claiming it'll be secure because it's "encrypted" that raised a red flag for me. Then I found out that they're not using popular and audited libraries like OpenPGPj
19. 229.▲
    by Leace 8y ago

    Key Transparency [0] uses the same model. Too bad the project seems inactive. [0]: https://security.googleblog.com/2017/01/security-through-tra...