[HN Gopher] Ask HN: Why does YubiCo need my private key?
___________________________________________________________________
Ask HN: Why does YubiCo need my private key?
Hi HN, I've been reading up on YubiKeys, which seem to be well-
regarded on HN. When doing my own research, I discovered that the
default authentication method requires a copy of the private key to
be stored on a validation server[1] (YubiCloud, by default). This
can be changed to a private validation server, however that would
also need to have a copy of the private key in order to work. My
question is: why is this necessary at all? Surely the same
functionality could be achieved with public-key cryptography rather
than requiring the private key to be uploaded[2] to a validator.
[1] https://docs.yubico.com/yesdk/users-manual/application-
otp/yubico-otp.html [2] https://upload.yubico.com/
Author : jadamson
Score : 42 points
Date : 2023-09-29 15:18 UTC (7 hours ago)
| cendyne wrote:
| An AES key is symmetric. Both parties need it for this
| cryptographic operation.
|
| The OTP key is separate from other keys that enable WebAuthn.
|
| Also, please don't use Yubikey OTPs. While they can't be brute
| forced like TOTPs, they can be phished. There are better
| technologies to implement.
| antonjs wrote:
| As someone shopping for physical 2FA tokens right now, do you
| have any recommendations?
| meepmorp wrote:
| YubiKeys are fine, just avoid their proprietary OTP thing.
| They're fairly configurable and also do FIDO/WebAuthn, as
| well as TOTP/HOTP, PGPcard and PIV.
| stouset wrote:
| YubiKeys.
|
| Just use FIDO2. I have no idea why OP is trying to use the
| YubiKey OTP protocol, which is legacy.
| jadamson wrote:
| I wasn't trying to use it, I was just looking around and
| came across the "YubiKey Personalization Tool", which
| doesn't show anything about FIDO2.
|
| Now that FIDO2 has been mentioned as something that solves
| this issue, it turns out there's another tool called the
| "YubiKey Manager", which allows you to configure/toggle
| various "applications" on a key, including Yubico OTP and
| FIDO2.
| slim wrote:
| nitrokey
| Alex63 wrote:
| I like my OnlyKey.
| aborsy wrote:
| My understanding is that, TOTP are equally vulnerable to
| phishing.
|
| Hetzner Cloud and Bitwarden use Yubico OTP.
| sneak wrote:
| Use U2F instead.
| advisedwang wrote:
| TOTP can be phished. The parent is recommending FIDO/WebAuthn
| [deleted]
| woadwarrior01 wrote:
| I'd recommend using the Yubikey as a GPG smartcard[1]. The
| private key stays on the Yubikey. I also use it for ssh. But make
| sure you have a backup key or two, just in case the primary
| Yubikey gives out. FIDO2 and all other regular Yubikey
| functionality still work with it.
|
| [1]: https://github.com/drduh/YubiKey-Guide
| donmcronald wrote:
| Pay attention to this warning:
|
| > Transferring keys to YubiKey using keytocard is a
| destructive, one-way operation only. Make sure you've made a
| backup before proceeding: keytocard converts the local, on-disk
| key into a stub, which means the on-disk copy is no longer
| usable to transfer to subsequent security key devices or mint
| additional keys.
|
| The order of backup, transfer matters. I did a similar setup
| years ago before that guide existed (or before I knew about it)
| and ended up with a backup of nothing. Lol. Thankfully I didn't
| used the key to sign anything too important and I learned the
| value of testing your restore procedure for _everything_ before
| relying on anything.
| ozim wrote:
| You know you shouldn't move private keys around?
|
| Backup key should have separate private key and all websites
| should allow adding multiple keys.
| effnorwood wrote:
| [dead]
| JamesLeonis wrote:
| I have a couple of Yubikeys and I can hopefully answer some
| questions.
|
| 1. The Yubikey specific OTP was turned on by default on both of
| my keys. The particular default is a Yubikey protocol. An
| alternative OTP is the _Challenge-Response HMAC_ [0]
| implementation which I use with Keepass.
|
| 2. The OTP is not necessary, and most websites use FIDO2/WebAuthn
| anyways. It would only be "necessary" if the service used that
| particular Yubikey OTP protocol instead of FIDO. I use the FIDO2
| functionality as my preferred 2FA, falling back on the Yubikey
| app for TOTP keys.
|
| [0]: https://docs.yubico.com/yesdk/users-manual/application-
| otp/c...
| piperswe wrote:
| I don't know of any services that use Yubico OTP (it's a legacy
| protocol) - everything's on FIDO2 nowadays
| jadamson wrote:
| Thank you, FIDO2 was the magic search term. I'd been going
| through the "YubiKey Personalization Tool", which didn't say
| anything about FIDO, when I should have been looking at the
| "YubiKey Manager" tool instead.
| wskemper wrote:
| It's still popular in certain corporate settings, where you're
| dealing with workflows that don't have _easy_ support for
| FIDO2. For example, certain embedded browsers for logging in to
| VPNs.
___________________________________________________________________
(page generated 2023-09-29 23:02 UTC)