Hacker News Reader

Comment by iudqnolq | Hacker News Reader

Sure: Enough support so that my life becomes sufficiently easier or more secure to be worth the cost.

I know that's a bit wishy-washy, but for example I think I could replace my memorized 1password password with something longer if I never had to enter it from memory, which would only be the case if I could use the Yubikey on all my devices.

View on HN

I use a yubikey with x509 cert and PIN for local auth to my Mac, and I use it for FIDO2 MFA everywhere that supports it, which includes my email account. That makes my email credentials radically more resistant to phishing, which is huge given that email is part of the recovery story for every other account.

If those aren’t enough, I guess yubikeys aren’t the right call for your threat model, which is fine.

I'd love to have that setup. The only problem is insufficiently mature support for the devices I use, Linux and Android. As I mentioned in an edit Yubikey local auth on Linux relies on a personal GitHub project abandoned years ago.

Bah, everything the GP described works perfectly in Linux. Yubikey local auth isn't just one Yubikey specific project. The Yubikey implements a fuckload of open protocols, the vast majority of which work perfectly in Linux.

Want local authentication? pam_u2f, pam_gpg, pam_x509 are all maintained.

The other person who replied to this seems to have gotten up on the wrong side of the bed, but the core of their suggestion is one I’d likewise recommend. I’m doing the yubikey local auth using the yubikey’s PIV applet, which holds standard x509 certs that can be used via pkcs11.

You should be able to set up PAM to use them in that way, without needing any yubikey-specific hijinks. Something like https://discourse.ubuntu.com/t/smart-card-authentication/260...

Thanks!

Mobile access is one of the reasons I hope a near term next gen iPhone has USB-C support directly. The lightning / usbc yubikey dongle is just too unwieldy in my experience.

NFC-capable dongles work great for this.

I use Yubikey NFC and tap it to the back of a Pixel. That is a relatively nice interaction.

Reply on news.ycombinator.com