Post AZ48MpjZnn5tJ9WNTk by jj@social.jjgadgets.tech
 (DIR) More posts by jj@social.jjgadgets.tech
 (DIR) Post #AZ48MpjZnn5tJ9WNTk by jj@social.jjgadgets.tech
       0 likes, 0 repeats
       
       An essay of YubiKey use cases.Copied from my post in the K8s@Home Discord server about some YubiKey use cases, very roughly formatted as I typed this not 5 minutes after I woke up.(Also, @truxnell said and I quote: “Any yubikey setup suggestions/tricks? Pinging @jj ***oh wise tinfoil hat sensei :tinfoil: ***.” So yes, this is where I got the nickname “tinfoil hat sensei” from. Thanks Nat.)OTP: so the “first slot” of the OTP part of YubiKey is automatically programmed as Yubico OTP, DON’T TOUCH THIS because it’ll screw up your TOTPs on the YubiKey and iirc FIDO2 as well for some reasonthe second slot however is blank, and I have it set to challenge-response. several things can use challenge-response but they’re quite rare: KeePassXC, Shavee (3rd party ZFS encryption “plugin”), Yubico Windows Login (for local accounts, onprem AD uses PIV via ADCS, Azure AD uses FIDO2 (and Azure AD is the only way to FIDO2 login to Windows :peperolleyes:))PIV: age1yubikey saves the key to PIVstore local CA certs if you want to fuck with CA stuff in homelab lol (budget HSM)S/MIME certs (but in my experience and another friend’s, S/MIME + YubiKey doesn’t work well with… any clients & OS combo at all)local AD passwordless login via ADCSapparently macOS login via YubiKey uses PIV but i don’t have a Mac to test lol, my 2015 is a brick until I get a new batteryGPG: email encryption between parties that both have GPG, auto incoming email encryption on Mailbox.org (ProtonMail requires their own bridges and stuff for decryption, YubiKey’s GPG is completely useless there, only FIDO2 for authn is useful for Proton)Git commit signingI use my YubiKey GPG for SOPS because I can’t be fucked to safeguard an agekey file and remember to copy it to the multiple OSes I use, only my cluster has an agekeySSH: 3 optionsSSH key using FIDO2, requires OpenSSH 8.2+ (resident keys allow storing the key on the YubiKey, it’s really nice to just go to any 8.2+ machine and ssh-add -K, then ssh-add -e when done, nothing else needed)SSH via GPG auth subkey (GPG is a bitch, but if you already have a distro that isn’t too stripped down it most likely is already installed and preconfigured anyway, I could use it on a random Kali VM with USB passthrough relatively easily)SSH PIV certificates instead of plain SSH keys (requires PIV .so libraries like Yubico’s, then ssh-add -s /usr/lib/libyubico.so.1 or something like that (can’t remember exactly), I don’t use this tho. fun fact: an ECDSA PIV cert in the PIV authentication slot can be used via GPG agent SSH too :kek:)also if you use Linux and macOS: god bless auth sufficient pam_u2f.so but please enforce FIDO2 PIN if pam_u2f.so is used on a device that is both portable and stores valuable, personal and/or sensitive data.LUKS decryption has a few YubiKey options (FIDO2, PIV, challenge response).As of this post’s date (16 May 2023), my experience with 1Password is it only uses YubiKey for initial 1P.com vault login (the login on 1P that requires Secret Key), subsequent logins after initial vault login are biometrics/PIN/master password only. Others report that BitWarden behaves the same.Lastly, do plan and consider your physical security (e.g. is your home safe enough for certain YubiKey configurations? offsite YubiKey for critical accounts?) as well as Disaster/otherwise Recovery (e.g. descendants/companions in event of user not available on Earth)#yubikey #cybersecurity #linux #authentication #passkeys #passwordless #infosec #security #mfa #fido #fido2 #pgp #ssh #encryption #piv