Hacker News Reader

Comment by jonas-w | Hacker News Reader

For full disk encryption, if you use systemd and not another init system, i'd also recommend systemd-cryptsetup, it's already installed on your machine if you have a relatively new systemd (at least 248). With systemd-cryptsetup you can use fido2, and your normal fido2 pin, to unlock your LUKS drive.

This also works with the YubiKeys "Security Key" series, that only have fido2 and no otp/chalresp.

View on HN

I actually considered that setup but decided against it. The thing is, if I did this, I would eventually succumb to convenience and would plug the key into the machine at all times. But that defeats the purpose: if a thief steals my computer they can just tap the key rather than know my password to unlock my disk.

You normally have and you should have a fido2 pin, which is just a password. A thief would need your laptop, your security key, and the fido2 pin.

Here is an article (from yubico) about fido2 pins: https://support.yubico.com/hc/en-us/articles/4402836718866-U...

This part can be frustrating for a novice adopting security keys. The key works out of the box without PIN. If you didn't come across the right guidance, you already enrolled keys without a PIN and now discover that you need to unenroll everywhere, set a PIN, and enroll again. And even with proper backup keys etc., it can be worrying whether you've forgotten some corner case and are about to lock yourself out somewhere by setting the PIN.

Reply on news.ycombinator.com