YubiKey 4C

https://www.yubico.com/product/yubikey-4c/

by ta_dhee • 9 years ago

213 255 9 years ago

yubico.com

_joel4• 9 years ago

Is it still closed source?

bogle2• 9 years ago

Yes, still closed source.

_joel4• 9 years ago

/me closes tab and gets on with day :)

[edit] Interested to know why people find the need to downvote this, I asked a question and got an answer. Please enlighten me so I don't err again.

js2• 9 years ago

Yubi's position on why they went closed source on the hardware seems reasonable to me:

https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...

jgrahamc• 9 years ago

Why are Yubikeys so expensive? I have one and use them but the price always gets in the way of having more.

AdamSC1• 9 years ago

In a lot of cases their clients are businesses who bulk buy the keys, brand them and provide them to their customers either for free or at a discounted price.

Those companies are usually financial services, online games with monthly subscriptions, and corporate IT/Security services. So they have a high customer LTV and the investment is worth it for them.

Yubico was smart to go after that market. It is costly to design, mould, manufacture, sell and support a hardware product, even something as small as this. Since you don't want your 2FA company to go out of business there is good value in knowing they have a stable business model that can actually support a company rather than just burning capital.

fuzzybeard5• 9 years ago

For something that authenticates you for 2 factor, I'd pay a lot more. After all, this is your key you use daily for the services you live off of. The value is a no brainer.

Ajedi322• 9 years ago

Probably because they're capable of way more than you're using them for. The ones that just do U2F are only $18: https://www.yubico.com/products/yubikey-hardware/

nickik18• 9 years ago

They do lots of stuff. A YubiKey 4 has GPG Smartcard, U2F, PIV (SSH,CA, Windows Remote Login), Static Password, Yubikey OTP, Challenge Response Mode (HMAC) and HOTP. It does a lot of stuff, I am amazed how cheap they are.

Pure U2F sticks can be done much cheaper. The Yubikey one only costs 18$, but the U2F standards was designed for cheap devices. You can get U2F sticks for less then 10$ on amazon.

rconti• 9 years ago

Yup. they're a bargain compared to most solutions

eecc• 9 years ago

I still don't get how people are ok using these things without a fingerprint reader...

bogle2• 9 years ago

Wouldn't that make it 3FA? I'd need my password, my physical key and my fingerprints?

JumpCrisscross• 9 years ago

One could then argue the Google Authenticator app running on my iPhone is 3FA, as one needs to be able to unlock my iPhone to access it.

_joel4• 9 years ago

They're used as second factor authentication, not on their own and are generally linked to a TOTP/HOTP mechanism. They (depending on which technology you use) create unique, pseudo-random codes to enter (linked to some salt+time value) along with a passphrase or another auth factor (could be a smartcard of course)

Freak_NL4• 9 years ago

Why? This is the hardware factor in a two-factor authentication scheme. Someone purloining your YubiKey would still need a PIN or password to proceed in most 2FA schemes. The only thing biometrics would add is preventing someone from physically taking your YubiKey and abusing it along with the knowledge factor gleaned from you. That is a valid concern in some specialized cases, but certainly not the common use case 2FA aims to address.

And even if it was; if someone is willing to physically intervene in your security by stealing your YubiKey, chances are they are willing to 'coerce' you to cooperate with unlocking a biometric lock as well…

slau• 9 years ago

Because biometric authentication is a joke in the security industry?

Biometrics are fine to identify someone. Biometrics, being public data, is not acceptable for authentication nor authorisation.

To use another example:

You get to border control, and present your passport. The agent ensuring that the description in the passport matches the person standing in front of him/her, that is identification. The agent verifying that your passport is genuine and valid, that is authentication. The agent giving you access to a country based on the laws and arrangements between those two countries, that is authorisation.

Anything that can be copied/stolen with a good enough picture or forgotten glass/mug is not good enough for authentication/authorisation.

KirinDave7• 9 years ago

You should turn off your fingerprint readers. Courts the world over are starting to agree with law enforcement that they have the right to take your fingerprints, and they have the right to do whatever they want with those fingerprints short of disclosing them to the public.

Sooooo... fingerprint auth is a useless security measure even for normal citizens.

SEJeff• 9 years ago

I've probably posted this a dozen times, but Dustin Kirkland (the Linux encryptfs maintainer) so eloquently put it that fingerprints (and all biometrics) make wonderful usernames, and horrible passwords:

http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...

serg_chernata• 9 years ago

It looks neat, can someone share personal experience or recommendations? Is this worth it? Is there a better alternative?

cafebabbe• 9 years ago

Had one, loved it, then lost it, then hated it.

baq• 9 years ago

that's why you always have to have two, preferably 3 - one stored off site somewhere. physical locks also come with at least 3 keys.

simias• 9 years ago

I use a Yubikey 4 with the GnuPG smartcard applet to secure all my password, sign my emails and connect to remote computers with SSH. It's super convenient and I'd never go back.

That being said I got a bit concerned about the use of closed source components in newer yubikeys (I believe that the yubikey 4 is open source and the later ones aren't, but don't trust me on that).

For this reason I also bought a nitrokey as a backup. It's a bit slower than the yubikey (I use 4096bit keys) but it works well. I really don't like the plastic cap on the nitrokey though, I feel like I'd lose it within a week if I started using it as my main key. The Yubikey doesn't have any protection at all but it looks sturdy enough that it doesn't really matter. It's been on my keyring for months and it seems to handle the abuse just fine.

jordskott• 9 years ago

To be honest, Yubikey was never really open source. Sure, they open sourced _some_ compomnents before but you coulnd't do anything with the source.

baccredited• 9 years ago

Do any of these RSA alternatives have an LCD display showing the id? Our work computers are locked down and USB is not an option.

drewg1232• 9 years ago

The OTP functions basically as a USB HID keyboard. So you can plug it into something that is not locked down (like a phone or tablet), and then just copy the code.

The drawback is that the code could be long. A few years ago, the codes were just 6 digits. My latest nano spits out a very long (20 char?) alpha-numeric string.

pmoriarty3• 9 years ago

I wouldn't mind a 20 char string. I regularly type passphrases significantly longer than that.

fuzzybeard5• 9 years ago

Is it just Mass Storage that'd disabled in USB or the ports themselves?

jalude• 9 years ago

You can have it behave like a keyboard and simply 'type' the characters of the one time password in. I don't know how locked down your systems but usually keyboards are allowed.

NikolaNovak3• 9 years ago

Do they work any better on iPhones?

-----

I decided couple of months ago to secure entire family. Bought half dozen Neos, worked out all the kinks on my computer + Android phone first, put everything in LastPass (I know, I know, I know... but you have to consider the target audience ;).... only to discover on "go-live" that my wife's iPhone 6s is bloody useless with the thing. Apparently iPhone doesn't fully grok NFC or something? Not sure... :-/

Freak_NL4• 9 years ago

Apple decided that users cannot use the NFC chip in it except for Apple Pay (for the foreseeable future). You don't really 'own' an Iphone in that sense.

NikolaNovak3• 9 years ago

  users cannot use the NFC chip in it except for Apple Pay

That... boggles my mind :-O

Thanks for the info. My wife is unfortunately locked into iPhone due to work standard, but something to keep in mind long-term.

artursapek3• 9 years ago

Seriously?

nobodyshere2• 9 years ago

Actually they can. Features are being added, for example using iphone's nfc chip as a work pass.

colept3• 9 years ago

Get a Lightning to Camera (USB) adapter. Works fine here.

gnopgnip• 9 years ago

The yubikey is the something you have. You can use the iphone in place of that.

Nullabillity2• 9 years ago

Kind of useless to have a C-only device this early. An A/C-hybrid would be much more useful, like Kingston's MicroDuo[1] series.

[1] http://www.kingston.com/us/usb/personal_business/DTDUO3C

kentiko• 9 years ago

It's an authentication key, not a flash drive.

michaelmior• 9 years ago

The same point still applies.

andresgottlieb• 9 years ago

It's a comment, not a logical proof

snovv_crash• 9 years ago

That doesn't change the fact that you may still need to use it in a friend's computer, or at an internet café.

amichal• 9 years ago

..or from YubiKey for 1$ more (then their USB c version)

https://www.yubico.com/product/yubikey-4-nano-usbc-bundle/

epistasis• 9 years ago

Could you explain why you think that? The audience for this is people that primarily use C-only devices; it was requested by customers.

I don't see the point of a dual device except to add size and expense. I'd rather just go with a dongle, as it can be reused.

ropiku• 9 years ago

They sell a Yubikey 4 with USB-C adaptor which looks like what you want: https://www.yubico.com/product/yubikey-4-nano-usbc-bundle/ Looks around the same size as Yubikey 4C.

tckr• 9 years ago

Make the price $5 and these will sell.

danjoc6• 9 years ago

Sometimes they do. They did when they launched yubikeys on github. You could get a yubikey with github logo on it for $5, limit 2. They were U2F only, but I still purchased two for the novelty.

monatron• 9 years ago

Presumably they sell at their current price, why drop it?

nickik18• 9 years ago

These keys will never be $5 but pure U2F only keys are almost already there. You can get U2F keys for 8-10$ already.

abhv2• 9 years ago

alternative is u2fzero, available on amazon for 8$, and totally open source. the difference is that yubi uses an nxp secure coprocessor, whereas the u2fzero uses atmel. there is the possibility of side-channel attacks on the u2fzero.

but for your family, it is better than nothing and much more cost effective.

Freak_NL4• 9 years ago

[…] there is the possibility of side-channel attacks on the u2fzero.

Interesting. How does that work? Have you any references to that?

adrianN• 9 years ago

https://github.com/conorpp/u2f-zero/wiki/Security-Overview

abhv2• 9 years ago

The Atmel chips do not claim that they have implemented counter-measures for power analysis, etc. Power analysis on a key operation is a dangerous attack if proper counter-measures are not taken. You can literally read off the 0/1 of each bit of the key as the key operation is underway if you monitor the power/timing.

The NXP chips inside the yubikey claim to be hardened against several such attacks (although I have not confirmed).

NXP is a cagey company. For example, I am a researcher, and I wanted to get the yubi-key's unlocked to write and test new u2f protocols on their hardware. They wouldnt sell me development keys, and claimed that the restriction was placed on them by NXP. I wrote half-a-dozen requests to the NXP people, and they never replied.

Tomdarkness• 9 years ago

The Yubikey 4 does a lot more than just U2F though.

ckok2• 9 years ago

You have a link? The only thing I get for u2fzero is their site with instructions on how to build one.

phonon• 9 years ago

Closest I could find that was still available is

https://amazon.com/HyperFido-K5-FIDO-U2F-Security/dp/B00WIX4...

bisby• 9 years ago

u2fzero is "Currently unavailable" on amazon. And the lack of housing makes me question how durable the device would be. The last thing I want is my u2f dying and locking me out of a ton of accounts.

bb884• 9 years ago

I've had one on my keychain for a while. It's rugged enough for day to day use.

The only issue is that the hole for the key ring has a thin wall, so I have a plastic coated keyring to prevent the metal from rubbing the hole.

jupp0r3• 9 years ago

Until there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats the whole point.

LeifCarrotson• 9 years ago

Not having it inserted defeats the whole point

How so? I would keep this on a keychain or lanyard (it looks rugged enough to handle that sort of environment). When I need to authenticate, I plug it in, when I'm done, I unplug it. That seems a lot more secure than leaving it in the computer all the time. If someone gets my computer and the YubiKey is always installed, that sort of defeats the purpose of having a separate hardware security device. In that case, why not just use Keypass?

eumoria• 9 years ago

I've had the standard USB version on my keys for about a year at this point. They're in my back pocket and take a bunch of abuse. Still works just fine.

nickik18• 9 years ago

Direct physical access to your computer is not the only thread. Even if you have in your computer all the time it gives you better logins, easier and safer. Specially protection from phishing.

When I leave my computer out of my eyes it usually locked (unlock with password), so I don't expect somebody to quickly go in and do something. If I leave for longer, I sometimes pull the Nano out and put it somewhere I don't lose it for a while.

The advantage of your system is that you can use the U2F screen unlock instead of the password.

akulbe• 9 years ago

Do you have to leave it plugged in to your computer the entire time? or just times you need 2FA?

fuzzybeard5• 9 years ago

You only plug it in when logging in.

danjoc6• 9 years ago

If that's what you do, why wouldn't you prefer something built in? Like TPM?

treve• 9 years ago

I'm kind of wondering what the benefit is over having something like Yubikey at all instead of something that's just software when you just leave it in all the time.

acdha• 9 years ago

Trust: a hardware token has a very limited interface where it can be attacked compared with a general purpose computer or phone.

Take the devices you use: how many exploits have there been in the last year where an attacker who could get you to click on a link, view an image, etc. could run code on the device? Maybe you have something like the iOS sandboxing between application which would stop a compromised browser from compromising your authenticator app but there are many cases where attackers have been able to bypass that.

Using a hardware token prevents almost all of those attacks and means that if you are compromised you'll have an easier time regaining control. They also have some nice benefits such as not running out of battery when you need them in an emergency.

tptacek10• 9 years ago

Your computer can in theory get owned up without you losing your SSH or VPN keys, even if your keystrokes are logged.

fuzzybeard5• 9 years ago

You can compromise software on a PC. You can't do that, as much, with a hardware key used for 2 factor authentication.

jupp0r3• 9 years ago

I specifically use it to store my gpg/ssh keys on it. The keys are generated on the device and have never been in any computer's memory. The key answers challenges from an SSH server with the appropriate response. I do not want to insert something dangling off my key every time I do git push.

fuzzybeard5• 9 years ago

This isn't something you should leave plugged in. It's a key after all used for authentication. Keep it on your keychain or in your wallet and plug in as needed.

wyager3• 9 years ago

If it's sufficient to authenticate a particular machine, not necessarily a particular user, leaving it plugged in is acceptable and convenient.

dastbe• 9 years ago

The security is that it requires physical presence (your finger completing a circuit) to perform authentication. Leaving it plugged in doesn't detract from that.

artursapek3• 9 years ago

Why do you need to keep it in? I have the blue U2f key and it's much larger. I just keep it on my keychain and only insert it while signing into something that requires it.

ionised• 9 years ago

What are the current alternatives to Yubikey?

Preferably looking for something open-source and in no way associated with Google.

bb884• 9 years ago

The U2F zero was on amazon for a while. But not anymore.

Unfortunately the guy who is doing it no longer has time for it.

nhf3• 9 years ago

If you're feeling crafty, you can create your own: https://github.com/conorpp/u2f-zero/wiki/Building-a-U2F-Toke...

mstade2• 9 years ago

Wait – Yubikey is associated with Google? Or did you mean that whatever alternatives people suggest mustn't be associated with Google?

nickik18• 9 years ago

There are some connections. The people who founded it. Google are early investors. Google are also one of the most important costumers.

I think that makes it even more secure. Google house lots of people running around with these.

moreentropy3• 9 years ago

Have a look at the Nitrokey, it's completely Open Source: https://www.nitrokey.com/

rogerbinns• 9 years ago

I haven't used it, but Trezor looks interesting, and there is a Trezor 2 coming soon. https://trezor.io/

The sweet spot is for Bitcoin wallets, but it does the other stuff (U2F, ssh, gpg, passwords). Hardware is interesting. Everything open source. You can add your own "apps".

U2F: https://blog.trezor.io/secure-two-factor-authentication-with...

wyager3• 9 years ago

Trezor is great. Tiny device, big enough display, good build quality.

nickik18• 9 years ago

I use both this and Yubikeys.

The external screen add even more security and that is very cool. UAF/U2F both have support for external monitors in the protocol, so its really good security.

The ssh/gpg stuff is less advanced then that of the Yubikey, all guides suggest running some special scripts. With the Yubikey you can set it all up so this is not needed. Maybe this works with the Trezor, but I didn't find any guides for this.

I really want Trezor to support UAF as well, given that it has a PIN entry system, this should work.

If you need a Bitcoin Wallet, Trezor is cool, if you want a tool primary for login (U2F/OTP/TOTP), a Yubikey is preferable.

j_s• 9 years ago

This may be enough: https://sc4.us/hsm/

Source: https://news.ycombinator.com/item?id=13033080

Paging HN user and product vendor: lisper

hollander• 9 years ago

I have a Yubikey, but almost never use it. I still don't get it fully, don't have a use-case where it totally works for me. Having one key is maybe part of the problem. If I lose it, what then?

danjoc6• 9 years ago

When I first got mine, I was the same way. I learned different bits in steps. First was yubikey-luks for full disk encryption. Then using my ssh key on it. Then GPG key on it. Then using GPG key for password storage with QTPass, OpenKeychain/Android Password Store. Then 2FA with gmail. I'm getting a lot more use out of mine more than a year after originally getting it.

johnnycarcin2• 9 years ago

For the ssh key, are you using your yubikey on multiple computers or just one? I just started looking at this but it seems like there is a bit of setup needed for each computer. I guess it might be worth it but would be interested to hear about others experiences.

drewg1232• 9 years ago

I was pretty paranoid about moving to 2FA for my personal account due to fears about getting locked out, but finally decided to take the plunge when I got a yubi for my work & realized I could also add my personal account to it. The nice thing about the Yubi is that decreases the chances you'll be locked out, because (if you're using it for a Google account, then) you still have a phone app, like Google Authenticator, that you can use to authenticate. And you've still got backup codes. And I also have two keys.

johnnycarcin2• 9 years ago

I'm in the same boat and actually submitted an "Ask HN" awhile back to see what others were doing (https://news.ycombinator.com/item?id=13567209). I have the plain ol' yubikey and also the NFC yubikey but I haven't found a good, real world use case for them. It might be that I'm just not the target market or that I haven't put enough time/effort into it. For me the big selling point was the FIDO stuff but so few providers seem to use that...

nickik18• 9 years ago

Check out some of my last answers in this thread. I use it for:

U2F (Google, Dropbox, Facebook, Github, Bitbucket), TOTP (Slack and everybody else that does not support U2F), Yubikey OTP (LastPass), static password for luks decryption (additionally to normal password), GPG Smartcard

The only feature Im not yet using is the PIV SSH stuff.

I also just like hitting the button and printing out OTPs when Im boarded.

artursapek3• 9 years ago

Most applications let you download backup codes for the event where you lose a key. But it's an anxiety I have as well.

tptacek10• 9 years ago

Some people will tell you to buy two Yubikeys and leave one as a backup. I don't think that's necessary. No matter what, you should generate a backup software key and keep it on offline encrypted storage; if you lose the token, just use the backup key until your replacement arrives.

It's even easier for Github and Google Mail. For web services, the right stack is:

* Hardware U2F token

* Backup software TOTP (Duo or Google Authenticator or whatever)

* Backup printed (or saved on offline USB key) passcodes

* Disabled SMS.

Unlike SMS, which is devastating to security even as a fallback, having a software TOTP option is basically fine; most of what U2F buys you is unphishability. This leaves you with two levels of backup, one of which is reasonably secure indefinitely.

merijnv• 9 years ago

Isn't disabled SMS overkill for most casual thread models? As I understand it SMS would require someone to MITM the telecom network OR snoop the local antenna when you receive it on your phone. Which is a danger if you expect, like, nation-state adversaries.

But if I'm, say, protecting my GitHub account against Russian mafia hackers, that still seems perfectly fine?

danjoc6• 9 years ago

Can you disable SMS on google? I've tried and have been unsuccessful. Phone is required to enable 2FA. Once that is enabled, I can add yubikeys. After adding yubikeys, I am unable to remove phone as a 2FA alternative.

buddylw2• 9 years ago

I don't think that the people complaining about the price of this key appreciate all that it can do. Most of those people would probably be better off with the cheaper FIDO U2F Security Key.

I haven't found anything else that manages RSA Keys, TOTP auth and U2F in a single package. I'm going to buy this because it plugs into my pixel phone and it seems like it'd be more secure and convenient than my current Neo with NFC.

tptacek10• 9 years ago

Annoying nerd pedantry: It's only sort of doing TOTP (Yubikeys don't have batteries, so need a software client to provide the clock), and on a slack with almost 300 crypto nerds in it, I don't know any of them that use the Y4 for TOTP (I'm preparing myself to be surprised in a minute when someone there reads this). TOTP is something you do on your phone.

moreentropy3• 9 years ago

TOTP with Yubikeys is great. You just need the Yubico Authenticator app to access the TOTPs. Works fine on phone using NFC as well as on my (Linux) desktop using USB. New phone? Install YK Authenticator, tap the YK and use your TOTPs.

buddylw2• 9 years ago

I only do TOTP on my phone. The Yubi Authenticator app is a drop-in replacement for Google Authenticator, but it adds significant security because the keys are stored offline in the yubikey and the crypto is done in the fob. Your phone is relegated to sending the time and displaying the OTP, which greatly reduces the attack surface of a standard OTP app.

The actual usage is exactly the same as Google Authenticator with 1 more step (NFC with NEO or plugging in the yubikey 4) to get the OTP.

nickik18• 9 years ago

In addition to what the others have said, I would point out that TOTP with the Yubikey/Yubico Authenticator has one other advantage. You can move between different android devices without problem. Its even nicer then Cloud-based Authy.

I was in a pinch once and had to do TOTP, so I grabbed the phone of my friend, downloaded the app and used it to log in.

tptacek10• 9 years ago

Note that this isn't just a U2F key; if you're looking for a token principally to log into web services with, this isn't what you want, and the token that does that costs less than half as much (it's the U2F-only token).

You want a Y4 if:

* You SSH into sensitive machines.

* You log into a VPN that you control and can configure to use the Y4.

* You're actually relying on PGP.

bb884• 9 years ago

Bitcoin wallet security. That's the next big thing.

platz• 9 years ago

what happens when you lose your yubikey? Has anyone ever lost their keys?

mackncheesiest• 9 years ago

But it's identical functionality to a Yubikey 4, just with type-C connector, and the product page as well as myself personally can verify that Yubikey 4 supports U2F

tptacek10• 9 years ago

I'm not saying the 4C doesn't do U2F. It's the same as the 4. I'm saying that if all you want to do is log into web services, you probably don't want the Y4.

StavrosK5• 9 years ago

Does anyone have a guide on how to store an SSH key on it? I only found PGP key guides (and I have my key on it), but not much for SSH. I also think it doesn't do ECC...

pfg4• 9 years ago

You can use the GPG key on the device for SSH authentication through gpg-agent. Here's their documentation[1] for this feature.

ECC keys should work, but haven't tried that (I use RSA-4096).

[1] https://developers.yubico.com/PGP/SSH_authentication/

amitshah• 9 years ago

There's this very nice guide that works well for Linux machines:

https://github.com/lfit/ssh-gpg-smartcard-config/blob/master...

nickik18• 9 years ago

Yes. You have to check out the PIV module. It can even be used as a CA.

https://developers.yubico.com/PIV/Guides/

There are a number of tools you can install yubico-piv-manager/yubico-piv-tool but check the guides.

I had some problems with this, somehow I could not add the key to ssh-agent, but that was related to the ssh-agent, not sure its a general problem.

Note, this does only support 2k keys. If you use the GPG Smartcard and a Authentication Subkey you can get 4k keys. The advantage of PIV is that you can actually use ssh-agent and you don't have to use gpg-agent. Gpg-agent does not have all the features that ssh-agent does, and for me that was relevant.

I prefer to keep the two separate anyways.

bergie2• 9 years ago

Great to have a USB-C option available, though bummer they didn't include NFC in this one

Sir_Cmpwn9• 9 years ago

Remember that closed source security-related products are a complete joke and you should spend your money somewhere else.

Filligree• 9 years ago

Any suggestions?

Sir_Cmpwn9• 9 years ago

Just use a TOTP app, at the moment. Note that because there are no U2F alternatives means that you shouldn't use U2F - not that you should settle for an insecure device.

KirinDave7• 9 years ago

Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question.

Yubikey has been around a long time and has made every effort to be a transparent company with a support for open source. Truth is, that is sometimes hard to do.

I found this article rather interesting, back when it first came out: https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...

Sir_Cmpwn9• 9 years ago

I've seen that article and it's a heap of crap. There's no reason they couldn't make the firmware read-only so you could verify it, then publish the source to audit and verify against.

Reminder that open source projects are not provably more secure, nor is it easy (or even possible in many cases) to assert the source you see made the binary in question.

I can (and do) read the code for security-related software, and I can at least check for obvious backdoors and flaws myself. With reproducable builds it is possible to assert the source you see made the binary in question (and security related software must support reproducable builds for this reason).

If you want to convince yourself the product is secure, that's up to you, but it's not.

ksk• 9 years ago

You are taking what you personally consider to be a guarantee and applying it to mean what everyone else considers to be a guarantee.

Unless you physically inspect each and every device (since they could easily run multiple lots) your faith is in the fabrication of all of the ICs used in the design. Not to mention that the computer you stick these into suffers from the same problem. On the theoretical side, all of the math which this is based upon is probably taken by most people on a faith basis. There is a lot of faith to go around. It just depends where you draw the line.

carterehsmith• 9 years ago

Well, with that logic, open-source security-related products are a complete joke, too.

- Microprocessor can look at the binary, recognize the patterns ("oh, this is OpenSSH trying to generate a key... lets give them an easily breakable one") and do whatever it wants with it.

Remediation: build your own compilers, build you own processors, from your own schematics, in your own foundry (cost: $billions), built by yourself.

Good luck?

chrisacky• 9 years ago

I bought a HyperFido but it just doesn't work on Ubuntu...

Was expecting to be able to use it to log in to Google using their 2FA key.. but only works on Windows from what I can see...

Anyone know anything about this?

nhf3• 9 years ago

Google supports the U2F standard for logins through Chrome. It's a theoretically standardized browser API, but it's only been implemented in Chrome so far.

lorenzhs4• 9 years ago

You're probably missing some library or other. I know I had to install something in debian unstable, but I don't remember what it was. U2F definitely works on Linux, though.

nickik18• 9 years ago

Probably a udev problem, you need:

https://developers.yubico.com/libu2f-host/

or maybe even better:

https://github.com/amluto/u2f-hidraw-policy

On the Yubikey its also possible to deactivate individual modes. If somehow U2F mode was disabled, it should not work anywhere, but if you don't use the other modes, maybe deactivate them. In earlier version there were some problems.

Probably its the first one.

esseti3• 9 years ago

I've a yubikey4 but i'm not sure how/why i should use it. I get the 2FA case, where it provides the One Time Password to login in some services, sort of what the phone does with the authy app (or am I wrong?). But, what about the ssh access? Should the key be used to decrypt the ssh key when accessing a server? so that, if i grab anycomputer i can login on my server if I've the yubikey with me? if so, how should this work and how can I set it up?

nhf3• 9 years ago

You can use it as 2FA for your SSH installation too[1].

[1] https://www.yubico.com/why-yubico/for-businesses/computer-lo...

pfg4• 9 years ago

You can actually store the key you use for SSH authentication on the Yubikey [1]. The main advantage is that the key never leaves the device, so even if your computer is compromised, your key is still safe.

Same thing goes for anything else involving GPG keys - email, signing git commits or tags, software releases, etc.

I don't personally use it for OTP. I do use it for services that support U2F (which is different from OTP, and has the main advantage of being immune to phishing).

[1] https://developers.yubico.com/PGP/SSH_authentication/

esseti3• 9 years ago

i'll give it a look. the potetntial of this device is still not clear to me.

nickik18• 9 years ago

I use it for lots of stuff.

Lets go threw it. Yubikey supports a number of different 2FA workflows. It supports TOTP (together with a phone), HOTP, Yubico OTP (that is there own standard based on HOTP) and of course most importantly U2F. U2F the new and improved 2FA standard that gives you interesting things like phishing protection.

It can also be used to issue a static password, and it can also be used in a ChallangeResponse mode (you send something it and it will get hashed). Both of these can be used to do decryption while booting for example.

Now lets get to the more advanced stuff. Yubikey is both a GPG Smartcard and a PIV Smartcard. Essentially this allows you plug in your Yubikey and then automatically your GPG and SSH keys will appear as if they are on the system. If your program, for example Thunderbird or SSH, tries to use the private key, it will require a PIN.

This allows you to have no key material on your computer. If you are hacked the attacker has no access to your private keys (and hopefully thanks to 2Fa not to many of your accounts). Even if you lose the keys themselfs your keys will probably not leak.

Depending on your situation and security needs you will want this stick either always plugged in your machine, or you want to carry a stick around on your keychain.

As for how to set it up, Yubico has lots of documentation.

https://developers.yubico.com/

If you have questions, you have my keybase :)

esseti3• 9 years ago

I wrote to you via the keybase tool. I've setted up the yubikey, copy the Access Key to the yubikey but the ssh-add -L does not list the key from the yubikey

IgorPartola3• 9 years ago

Until these things work well with phones, I can't buy into them. I have a U2F key that I use as a shortcut for accessing things like Google's services. But I am sticking to always using either Google Authenticator or SMS, if it's available, as a primary option. When I am looking at a website in bed on my phone, and my YubiKey is in my laptop downstairs, I can't say I am happy that I can't access my account.

I think the form factor for these things is just wrong. I don't always have my keys with me. I do have my phone much more frequently. Even more frequently I have things like my Pebble. Maybe some kind of NFC interface with a wrist watch would be a better alternative.

bergie2• 9 years ago

They have a NFC yubikey available, and most new phones work with USB-C (which this one has)

dgacmu• 9 years ago

I can confirm that the NFC support works (yubikey neo with a nexus 5x) - but very few applications and sites support it.

colept3• 9 years ago

They do work with phones. I have an iPhone with a Lightning-Camera (USB) adapter and use it all the time.

arcdigital• 9 years ago

Unfortunately, not for U2F though

lorenzhs4• 9 years ago

On Android, the Google Authenticator app handles U2F via NFC. Sadly not possible on iOS.

stinkytaco• 9 years ago

For the web, yes, but I don't know any native apps that use it. I still need an app password for gmail, for example.

ci5er3• 9 years ago

I think I'm not understanding the problem. I have cloned keys (for backup + two locations), with Yubico Authenticator. Is the problem NFC on iOS or that you don't want to clone your keys?

Ajedi322• 9 years ago

How do you clone a YubiKey? I thought the whole point of having a hardware token in the first place was that it's _not_ easily copied?

IgorPartola3• 9 years ago

My problem is that while I can reasonably guarantee that my YubiKey will be near my laptop when I use it, I generally can't guarantee that my YubiKey will be near my phone or tablets when I use them. I also don't really want to keep plugging in a physical key into my phone every time I want to log into, say, American Airlines to check the status of my flight, or into PapaJohns.com every time I want to order a pizza.

NFC makes this a little easier, but I still usually don't keep my keychain (that is my physical keychain with my house and car key) on my nightstand, while I do keep my phone there.

tl;dr: Laptop + 2nd Factor = YubiKey. That's OK and it works.

Phone/tablet + 2nd Factor = ???

nickik18• 9 years ago

Whats the point of having two factors at all if you are getting an SMS or using a TOTP token that is stored on the phone itself.

The phone does not force re-entry of this stuff so often that it would bother me.

When I am on my laptop, I absolutely love the Usability. Its much better then SMS or TOTP.

tomfitz• 9 years ago

U2F and HOTP (Google Authenticator style 2FA) are not mutually exclusive.

I have both enabled on the sites that support both.

I use U2F when I have the key near me, and use HOTP on my phone otherwise (like you, my phone is typically closer to me than my U2F key).

A common response at this point goes "But then doesn't introducing HOTP remove the security benefits of U2F?" No. One of the main benefits of U2F is that it is phish-proof: the U2F key cryptographically authenticates the server, rather than the user eyeballing the address bar, which is how server "authentication" works with HOTP.

herpderperator• 9 years ago

I use the Yubikey Neo with my phone via NFC to unlock my master password database which I use KeePass for. I wear my Yubikey on my necklace, tucked under my shirt and never remove it (it's waterproof, I shower with it.) I type my master password and just tap my phone to my chest to unlock.

calinet6• 9 years ago

Screw it, let's all get chips embedded in our fingers.

crusso• 9 years ago

I was just looking around yesterday for a programmatic way to encrypt/decrypt a file with a USB fob. I used an Aladdin fob a while back for a similar project. The encryption was symmetric but the fob kept the key and it couldn't be exported - so it was safe enough for my application.

Is this Yubikey capable of something similar?

wyager3• 9 years ago

You could do OpenPGP encryption. It will generate a symmetric key, encrypt the data with it, and then encrypt the symmetric key for the yubikey's pubkey.

escapologybb9• 9 years ago

I REALLY wish it were possible to use one of these devices without using your hands. I'm quadriplegic and would love to use one of these to unlock my computer, bank passwords etc etc. But you have to touch a finger to almost all of them to trigger the OTP, or whichever authentication and they happen to be using. I would absolutely love to be able to lock and unlock my Mac without an able-bodied person helping me, because really what is the point of me having a password if I tell it to a third party?!

Obviously the vast majority of people who use these devices are able-bodied and are able to use them as designed, but if somebody solves this problem there really is a market for it. They are great products, and if it weren't for this one stumbling block I would definitely be using them in my daily life. The inside of my laptop is the only privacy I have, and being able to have complete control over the locking and unlocking of it would be amazing.

It would be great if Apple made it possible to use the accessibility software on the login screen, that way I could tap in my own password but you can't use the accessibility software until you are inside the OS. Grrr.

Anybody got any ideas about how I could solve this, or any direction I could investigate?

(Sorry for mildly hijacking the thread, but thought it was somewhat relevant)

lytedev• 9 years ago

Why not run an operating system that does let you use accessibility software at the login screen?

cbhl2• 9 years ago

Does Windows 10 let you use accessibility software on the login screen?

escapologybb9• 9 years ago

My friend, if you could find me an operating system that can do that, and then once inside the OS enable me to use every single function of the operating system like an able-bodied person in the way the Apple's does I'll give you a small prize.

I would absolutely love to use free and open source software for both my operating system and everything else, but only Apple provides an experience for people with profound disabilities that even comes close to the experience normal people have with their computers.

This reply might come across as snarky, but it isn't and I really have tried to find other operating systems that would allow me to do this. Not found any yet in a decade.

ilyaeck• 9 years ago

Technically, this could/should have been already solved with voice authentication. Nuance and other companies have been claiming/pushing it for a few years now: http://www.nuance.com/for-business/customer-service-solution.... I'd actually expect Apple to be the first big player to incorporate that, as they've been a leader in accessibility. Maybe somebody should sue them for discrimination to accelerate the process.

escapologybb9• 9 years ago

Yeah, I've been using voice dictation software since I became quadriplegic over a decade ago and they were talking about it then but it's not materialised yet. I would imagine that it's going to be Apple there's going to be first in this area, but I'm not convinced they're going to do it for accessibility reasons, I think they're going to do it for payment/password reasons. Which if I get the trickle-down benefits from then, go Apple!

cbhl2• 9 years ago

IIRC, the main reason that accessibility software doesn't have access to login screens is because malicious software has historically used accessibility APIs to steal passwords (e.g. by eavesdropping on a login screen, or by presenting a fake one and then using the accessibility APIs to pass through the password to the real one).

escapologybb9• 9 years ago

I think you are absolutely correct, and it's a really good reason not to switch the accessibility APIs on until the OS is fully decrypted and loaded.

Yep, right there with you and agree and everything. Still, sucks balls to be disabled in this situation and I'm also fairly sure that Apple has the engineering talent to make this possible. One would hope, anyway!

zhengyi132• 9 years ago

I'm reminded of the brief experiences I had w/ Greg Priest Dorman and his physical computing setup, which had him attaching keyboards to his hands, and displays to his glasses.

This is a really hacky/bespoke idea, and I apologize if I'm being naive, but I wonder if you might be able to string a Yubikey Nano (https://www.yubico.com/product/yk4nano/) via a USB extension cable to someplace accessible to you around your head? Someplace you could trigger it with head motion?

You'd still have to figure out integrating the Nano with your login screen, your password manager, etc, but this seems like it might maybe be a viable first step.

escapologybb9• 9 years ago

I thought of this when the Yubikey first came out, but apparently it needs to be your finger that makes the connection. I'm not sure if that's still the case, because like you I just assumed I could extend the key somewhere around my chin controller and then use the tip of my nose to activate the key. I believe the tip of your nose is actually fairly unique FYI.

But yes, that would be one solution and great minds think alike. :-)

cr0sh• 9 years ago

Since it's a capacitive touch device, you really just need something conductive to touch the pad and connect it to "ground".

Maybe someone you know could take the yubikey device, attach a wire to it, then connect up a relay or something that could be controlled (using whatever interface you already have - I'm not that familiar with such medical devices) to activate the relay. When the switch contacts close, the other side of the relay could be connected to an earth-grounded point. That should activate the yubikey (I believe).

Note that the wire and relay and such will need to be shielded as well (to prevent stray capacitance - like somebody walking by or such - activating it). Coaxial cable like that used for oscilloscope leads would be great, and put the relay inside a metal box (and connect the shielding of the cable to the box).

Hmm - this is getting more complicated than I thought - but I think the basics are there. Here are some other links that might help as well:

http://playground.arduino.cc/Main/CapacitiveSensor (has a nice diagram/schematic of how these form a "circuit" for the microcontroller - this may or may not be what the yubikey uses)

A couple of PDF app notes from Texas Instruments on implementing capacitive sensing:

http://www.ti.com/lit/an/snoa952/snoa952.pdf

http://www.ti.com/lit/an/snoa926a/snoa926a.pdf

Good luck, and I hope this helps or leads somewhere for you!

escapologybb9• 9 years ago

Thanks for the links, they look really useful and it's only just occurred to me when you pointed it out that when a person such as the key they are completing a circuit. If I could do that in someway that could be unique to me, then that might just be possible to do. I just need to find somebody to do the soldering!. :-)

Shendare• 9 years ago

It sounds like you would be better served with a Bluetooth proximity-based device like a Gatekeeper.

http://www.gkchain.com/gatekeeper.html

I haven't looked into the OTP functionality of it, since I decided to go with a YubiKey myself, but a friend loves it for hands-free automatic locking and unlocking of his computer as he comes and goes.

escapologybb9• 9 years ago

That looks great, thank you for the link. I would love to try one of those devices, I don't have great memories of this kind of unlocking though.

I can't remember the exact name of the product, but I installed it with good faith and it completely locked up my Mac so badly I had to reformat the computer.

So colour me a little reticent to try this, although if the gatekeeper guys are reading this I'll be happy to beta test one for you. You know, purely for accessibility reasons. :-)

Cenk• 9 years ago

You could buy an Apple Watch and use that to unlock your Mac based on vicinity: https://support.apple.com/en-us/HT206995 Only works on newer MacBook though.

algesten• 9 years ago

I can confirm this setup works quite well. Initially it was a bit hit/miss whether it would unlock, but they clearly fixed something, it's much better now.

gcb02• 9 years ago

1. enter company you don't work at and steal laptop at lunch hour

2. walk to cafeteria with laptop that looks like any other. let owner watch unlock it for you.

3. profit!

4. optional, return laptop before lunch is over for full stealth.

sulam• 9 years ago

I had very little luck trying to set this up, and it required me to switch to a different second factor authentication that ended up complicating my life for everything else. Do Not Recommend.

nickik18• 9 years ago

Yubico has another decive the Nano. It is designed with a switch instead of a button. I am almost sure that you could tie a string around it and then you could maybe pull that somehow, connect it to something mechanical or something.

Mmmhh, why not test this ...

... I have just tried this out. I used the wires from an old headphone and tied it to the trigger. I can Trigger the single click by pulling on the wire. I even managed to trigger the long click, but that was not very practical. I tried pulling it with my mouth, but since you don't need that much force, maybe connect to headphones or something would be enough. My laptop was constantly shifting about, but maybe if you have setup where the computer is fixed, that might be less of a problem.

You can configure the static password on Slot 1 (single click) and you can still use U2F if you like (You can even login with U2F and use Slot 1 for something else as well).

I don't know what your setup is, but that's the idea that jumped to my head. Sorry if it is stupid.

dingo_bat3• 9 years ago

Windows hello might help you. There are laptops that use depth mapping infra red cameras with the native face recognition in windows. Probably the best hands free unlock method.

mrmondo• 9 years ago

I wish you could use these with macOS's CoreStorage to unlock FileVault 2's full disk encryption in combination with a password. I wonder if it'll be possible at any point...

MikeKusold• 9 years ago

I've done OSX authentication (mainly adding 2FA to the login screen), and Apple doesn't provide any mechanism to interact with unlocking FileVault.

However, with the Yubikey you can type in your password, then have the Yubikey enter your static password. That way you sort of get 2FA for the unlock screen.

avenoir• 9 years ago

So I got one 4 months ago and quickly found out that I understand next to nothing about it. I really thought it was going to be a plug-n-play solution but it was far from it. It took me nearly an hour to get my google account setup to use it. For some reason the little wizard thing on Google that "syncs" your yubikey was giving me trouble. After I finally got that part working i pretty much forgot about the whole thing. I had plans to also use it with KeePass in addition to Google but after reading that you basically have to hack this thing to work with both I pretty much decided it wasn't worth the effort. It's really sad how great this little thing is and how much of a pain it is to actually get any use out of it.

ruimarinho• 9 years ago

Here's my hands-on review with the new YubiKey 4C: https://news.ycombinator.com/item?id=13637771

philip1209• 9 years ago

They appear to be sold out already.

YubiKey 4C

Related Stories