Posts by jj@social.jjgadgets.tech
 (DIR) Post #AZ48MpjZnn5tJ9WNTk by jj@social.jjgadgets.tech
       0 likes, 0 repeats
       
       An essay of YubiKey use cases.Copied from my post in the K8s@Home Discord server about some YubiKey use cases, very roughly formatted as I typed this not 5 minutes after I woke up.(Also, @truxnell said and I quote: “Any yubikey setup suggestions/tricks? Pinging @jj ***oh wise tinfoil hat sensei :tinfoil: ***.” So yes, this is where I got the nickname “tinfoil hat sensei” from. Thanks Nat.)OTP: so the “first slot” of the OTP part of YubiKey is automatically programmed as Yubico OTP, DON’T TOUCH THIS because it’ll screw up your TOTPs on the YubiKey and iirc FIDO2 as well for some reasonthe second slot however is blank, and I have it set to challenge-response. several things can use challenge-response but they’re quite rare: KeePassXC, Shavee (3rd party ZFS encryption “plugin”), Yubico Windows Login (for local accounts, onprem AD uses PIV via ADCS, Azure AD uses FIDO2 (and Azure AD is the only way to FIDO2 login to Windows :peperolleyes:))PIV: age1yubikey saves the key to PIVstore local CA certs if you want to fuck with CA stuff in homelab lol (budget HSM)S/MIME certs (but in my experience and another friend’s, S/MIME + YubiKey doesn’t work well with… any clients & OS combo at all)local AD passwordless login via ADCSapparently macOS login via YubiKey uses PIV but i don’t have a Mac to test lol, my 2015 is a brick until I get a new batteryGPG: email encryption between parties that both have GPG, auto incoming email encryption on Mailbox.org (ProtonMail requires their own bridges and stuff for decryption, YubiKey’s GPG is completely useless there, only FIDO2 for authn is useful for Proton)Git commit signingI use my YubiKey GPG for SOPS because I can’t be fucked to safeguard an agekey file and remember to copy it to the multiple OSes I use, only my cluster has an agekeySSH: 3 optionsSSH key using FIDO2, requires OpenSSH 8.2+ (resident keys allow storing the key on the YubiKey, it’s really nice to just go to any 8.2+ machine and ssh-add -K, then ssh-add -e when done, nothing else needed)SSH via GPG auth subkey (GPG is a bitch, but if you already have a distro that isn’t too stripped down it most likely is already installed and preconfigured anyway, I could use it on a random Kali VM with USB passthrough relatively easily)SSH PIV certificates instead of plain SSH keys (requires PIV .so libraries like Yubico’s, then ssh-add -s /usr/lib/libyubico.so.1 or something like that (can’t remember exactly), I don’t use this tho. fun fact: an ECDSA PIV cert in the PIV authentication slot can be used via GPG agent SSH too :kek:)also if you use Linux and macOS: god bless auth sufficient pam_u2f.so but please enforce FIDO2 PIN if pam_u2f.so is used on a device that is both portable and stores valuable, personal and/or sensitive data.LUKS decryption has a few YubiKey options (FIDO2, PIV, challenge response).As of this post’s date (16 May 2023), my experience with 1Password is it only uses YubiKey for initial 1P.com vault login (the login on 1P that requires Secret Key), subsequent logins after initial vault login are biometrics/PIN/master password only. Others report that BitWarden behaves the same.Lastly, do plan and consider your physical security (e.g. is your home safe enough for certain YubiKey configurations? offsite YubiKey for critical accounts?) as well as Disaster/otherwise Recovery (e.g. descendants/companions in event of user not available on Earth)#yubikey #cybersecurity #linux #authentication #passkeys #passwordless #infosec #security #mfa #fido #fido2 #pgp #ssh #encryption #piv
       
 (DIR) Post #AZ48MtdLIuU5OydSJk by jj@social.jjgadgets.tech
       0 likes, 0 repeats
       
       Is it just me, or does anyone else find that when you shower, you’ll soap/etc your skin, then rinse it, and find that it’s still very oily/greasy/etc and you have to run the soap/etc back?Pretty sure I’m doing something wrong but I’m much better at troubleshooting computers and tech stuff than myself.
       
 (DIR) Post #AZ48Mtq6XSh02YbeD2 by jj@social.jjgadgets.tech
       0 likes, 0 repeats
       
       Also: is it just me, or does higher pressure on the showerhead help remove oil better than more soap or scrubbing?I'm the only one who uses as much pressure on our showerhead than both my parents do.
       
 (DIR) Post #AZ48Mu2rm0tug8Zq6K by jj@social.jjgadgets.tech
       0 likes, 0 repeats
       
       damn I really suck at life but I'm pretty alright with tech and computers, major skill issue LOL
       
 (DIR) Post #Aa3G8uLbcxeLg8xQjA by jj@social.jjgadgets.tech
       0 likes, 0 repeats
       
       I'm finally writing an #introduction toot LOL.I'm "JJGadgets" online, you can call me JJ, everyone does.My life is #tech, nothing brings me more joy and zen than sitting in front of my screens. Maybe except for Japanese food.I use and prefer #linux for both server and desktop use, despite its flaws. I live in the #commandline. Been that way since I first jailbroke on iOS 5 and installed MobileTerminal.I study #infosec but textbooks and lessons don't even come close to doing justice to what #infosec is all about. I like to think that I live and strive to live the infosec life, including my mindset. (After all, that's why @truxnell started calling me the "tinfoil hat sensei" LOL)I do #Kubernetes @ Home, and maintain my cluster state in #git then apply it with tools like #FluxCD. My #homelab repo can be found at https://biohazard.jjgadgets.tech (will always 301 redirect to my latest Git remote of choice, in the event it changes). I think using #GitOps/IaC to declare desired security-related state (policies, rules etc) makes managing security a lot easier.I try to follow "Principle of Least Privilege" for my homelab, and especially for Kubernetes security, using tools such as network policies (#netpols), policy engines, secrets management, identity management, strong #authentication, and access control. For example, my homelab Kubernetes cluster heavily uses netpols everywhere to default-deny and only allow the necessary network traffic for any given app to work.I am also very interested in strong authentication methods such as #passwordless #fido2 / #webauthn (#yubikey and #passkeys) and where possible, I only enroll FIDO2 MFA, and choose the passwordless variant if available.I try my best to use privacy-respecting software where possible, as I believe in maintaining transparency and control over the #privacy of people, regardless of online or offline.I also believe in #opensource, too many times we've been shown the consequences of relying on closed source software, so where possible I always prefer open source.Outside of the screen, admittedly I'm terrible at life stuff, and it's very hard for me to be interested in much of anything other than stuff on or related to a screen/device (I basically only talk tech stuff LOL). I'm working on changing that in the event I burnout hard again (though I still haven't found a non-tech interest yet, as of writing). I've burnt out multiple times despite still being a student, and thus I now (try to) take as much necessary measures as I can to avoid over-working, over-stressing or over-exerting myself.That's about it, let's chat (or toot?)!
       
 (DIR) Post #B5DdxeLx2X4uuVcNOK by jj@social.jjgadgets.tech
       0 likes, 0 repeats
       
       @whitequark @niconiconi have you tried over mobile data + WireGuard?Apparently others say it's atrocious but I feel like it's line rate of my mobile data (whose upload is like 10-20Mbps on 4G and 35-50 on 5G SA anyway)
       
 (DIR) Post #B5EmSbv97v5v8RJXqC by jj@social.jjgadgets.tech
       0 likes, 0 repeats
       
       @whitequark @niconiconi oh I thought Cat was referring to Tailscale as in Tailscale for a remote "road warrior" client out of the physical area of the LAN, seems I'm mistaken now that you pointed it out.