Hacker News Reader

Comment by jolmg | Hacker News Reader

As a Yubikey user, what stops me from considering this or the Librem key is the lack of confirmation button / touch sensor (and LED).

View on HN

I do wish the Yubikey had a slider like the webcam covers so you could prevent accidentally pressing the button.

ccccccidufjlndefkacuknijintbntjnkdnrrtncrkfi

Maybe you have the nano? I can't imagine touching the Yubikey 4's touch sensor by accident. In fact, I can't imagine my hand touching USB devices by accident.

I got one earlier this year when they upgraded my work laptop, and found out that was a button when I pressed it accidentally while removing it - got the whatever-it-is dumped into a random terminal that happened to be in focus. Didn't hear what version it was, but it looks like a Yubikey 4.

In your case, though, you didn't know that it was a button. Now that you know, I doubt you'll press it again by accident, since there's a lot area around it to avoid the button.

> got the whatever-it-is dumped into a random terminal

I don't use that feature, but I believe it can be configured to either be an OTP or a fixed password.

Looking it up, if you or malandrew don't use it, you can disable it by deleting the OTP programming that comes in slot 1 by default:

  ykman otp delete 1

You could plug it into a USB cable with a built in switch which disconnects power/data.

If you don't use the Yubico based 2fa, you can completely disable it and prevent the string output. Nowadays, most sites are using Webauthn/U2F and that will continue to work if you disable Yubico's proprietary 2fa implementation.

I always install yubiswitch [0] to prevent accidental yubisneezes. It lets you disable it from the Mac menu bar until you need it.

[0] https://github.com/pallotron/yubiswitch

You can move OTP generation to slot 2. This prevents accidental triggering by requiring a much longer press.

https://support.yubico.com/support/solutions/articles/150000...

If you don't use OTP, I definitely recommend turning it off as it contains your YubiKey serial number and can be used to identify you. https://medium.com/hackernoon/avoid-leaking-your-identity-wi...

I've been meaning to check these out for a while as I'm totally useless (although, in security terms my chaos probably means I'm securer... just not conveniently-so) with password organisation.

I more mean all the second tier shit I could barely care less about, but have to manage across multiple machines.

I also remembered that if I subscribe to ArsTechnica, they give you a 'free' key for your $50 subscription. Not bad when the keys cost $45!

Anyway, thanks for the prod!

(I'm not in any way affiliated with Ars or CondéNast - I don't benefit from mentioning their offer here - I'm just a reader and your prompt made everything fall into place!)

Yeah, same.

It does not have a button but still a touch sensor, so you have to touch the key to confirm (at least i have to for mine)

Sorry I should clarify that applies to the fido (not sure about the others)

The touch sensor also works for the OpenPGP smartcard.

Reply on news.ycombinator.com