Hacker News Reader

Comment by daurnimator | Hacker News Reader

I consider best practice to be using a hardware token.

My favoured solution is to use a yubikey via gpg: with this method you use your gpg subkey as an ssh key. The yubikey 4 supports RSA 4096 bit keys, if you need NFC then the Yubikey Neo supports max RSA 2048 bit keys.

View on HN

If you are going to set this up, sit down and spend an hour thinking about your backup and recovery strategy first. I'm familiar with an organization that did a POC for 2FA using them and had a surprisingly high failure rate.

I order 3 for each user, and tell them to keep the third somewhere really, really safe.

Maybe the safest thing is to not give them the 3rd one, until they ask you to pull it out of your safe.

This. It's so cheap and easy to use a hardware token for your GPG and SSH keys nowadays (YubiKey 4! TPM! Smartcards!). If you're not using one, you should.

Do you have a list of guides you recommend for getting started with YubiKey?

I found this guide to be pretty comprehensive: https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubike...

I have tried this for Windows and could not find the right magic to bring my yubico and ssh keys together (keepass otp stinks). What am I missing?

I haven't done the setup on windows before; but gpg4win does the auth correctly, and it automatically hooks up to putty!

If you don't know already the OpenPGP implementation used in the new Yubykeys is no longer[1] open source. Not that it really matters, since you couldn't verify the running code anyway, but this doesn't make me feel I should trust them.

[1]: https://www.techdirt.com/articles/20160515/02094934446/bad-n...

The other nice benefit of this is that now you have pgp keys for your organization to which you can encrypt backups and suchlike.

A good practice to enforce (if you can) is to only share credentials with your coworkers if they're gpg encrypted. e.g. coworker asks for password to some AWS box? encrypt it to their GPG key and email it to them.

- coworker asks for password to some AWS box?

To be clear, GPG encrypted is better than plain text for all sorts of secrets, but using a single account and passing around passwords won't scale. (Or rather the security implications of everybody having root access via a single shared account and passing the password around should frighten you.)

Ideally there's some sort of mechanism so all users can login to their own account on servers (from puppetized ssh keys to LDAP, among others), and no one is actually passing around passwords.

Reply on news.ycombinator.com