Hacker News Reader

Comment by danjoc | Hacker News Reader

Using zx2c4 pass with a Yubikey 4. Passwords are GPG encrypted. The private key is on the Yubikey and cannot be read out. The Yubikey 4 is set to require a touch per password unlock. The only passwords at risk are the ones unlocked. At that point, the trojan could install a keylogger and have the same amount of success.

Losing the password store isn't a problem either. It has a git remote on a USB stick. There's a backup if it's ever lost.

View on HN

This is interesting. I am not well versed on yubikey, but does it allow you to have a similar setup with other password managers, like keepass? (Meaning, one press per one password) Or is it just a substitute for typing a master password?

There are several integrations, but I don't have Google Play Services on my phone, so I only use what's available via F-Droid. See my other comment in this thread.

https://www.yubico.com/support/partners/#password-management

The touch setting is specific to OpenPGP keys. If you set it, it works that way for all uses of your OpenPGP key. You can turn it on to see if you like it. If you do, you can also set it to 'fix.' Once fixed, it can never be turned off again without deleting the private key and starting over.

https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_...

In the case you what to use the some passwords on iDevices, what would you recommend for password db?

EDIT: irremediable posed the same question at the same time ;-)

iOS doesn't have an NFC API. Thanks Apple.

https://www.yubico.com/products/yubikey-hardware/yubikey-neo...

Works okay on Mac OS with GPGTools and QTPass.

In that setup, how do you handle needing passwords on your phone?

Which phone? If it is Android, you could root it and use the same commands. Else, if you don't want to root or are using iOS there is software available for LastPass and 1Password.

There's an app for that. Android Password Store[1]. You can use a Yubikey Neo with NFC in combination with Open Keychain[2]. Both are available on F-Droid.

[1]https://github.com/zeapo/Android-Password-Store

[2]https://github.com/open-keychain/open-keychain

So what happens when you lose the yubikey?

You can encrypt a folder to multiple public keys. Good for having a backup yubikey, sharing a group of passwords with a spouse or other vip, etc.

Reply on news.ycombinator.com