Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yubikeys, for me, are convenient second computers for burying private key material that is only accessible via the physical presence check.

I feel I am 10,000x more likely to be attacked from inside my computer by a digital intruder than from any other vector. I lock my Yubikeys with a PIN but I’m not convinced it really protects me against anything that might actually happen to me. Jason Bourne, I am not.

If you, on the other hand, face targeted physical threats on the daily then you have my sympathies. Stay safe.

(Ps: any recommendations for an HSM with a more exciting presence check? I’d like to shoot a hoop / shoot a tin can / shoot a shot of wheatgrass every time I log in, rather than just press an ambiguously hello/green blinky light.)



Your question implies that the yubikey is an HSM. It isn't. It has a secure element.

If you want to implement your own novel test of user presence, you could get an F-Secure USB armory device (https://www.f-secure.com/en/consulting/foundry/usb-armory) and tap into the GPIO.


Yubico does, however, make an actual HSM. https://www.yubico.com/products/hardware-security-module/


by name only. it is also not an HSM by commonly understood definition. epoxied chip isn't enough to declare HSM-ness


I was on a team that evaled it for FIPS compliance. It's a full, FIPS compliant, HSM. It's $650 but that's still on the low side for an HSM.


Trezor - I've been using one for years and it's great. Also you can backup/restore the seed (so you don't need to register multiple devices).


I just ran across this comment, and realized it also works with gpg. I really wish yubikeys supported this backup mechanism as well (given their size), but I'm very tempted to make the jump.


I haven’t used yubikeys in a while, and they never supported backups, but they did support key import for GPG when I used them — so you can make a key some other way, and then put it on as many yuvikeys as you care to.

Isn’t that enough for your use case?


That's actually the process I use right now. The problem is that it relies upon an old laptop and several usb keys for backup. It's much easier to backup 24 words on a sheet of paper than a full gpg key.

Plus, those 24 words can also recover your u2f keys, crypto wallets, etc. The 24 word backup is something crypto has gotten right that I wish private key setups would replicate.


> Trezor - I've been using one for years and it's great. Also you can backup/restore the seed (so you don't need to register multiple devices).

Trezor does not make use of a secure element https://blog.trezor.io/is-banking-grade-security-good-enough...


I don't know the details but it doesn't sound great if you can exfiltrate secret material – the seed? – from a device.

A good smartcard should generate its own keys, on device, and only divulge them when persuaded to do so by an electron microscope.


You can't exfiltrate it - you can generate a seed externally and load it in, and back it up if you choose.


You can extract the seed, clone it into a new device, and get the exact same device with the same private key material?


Yes, but you can extract it only once; the device will refuse to provide it if it's already been provided.


https://xkcd.com/538/




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: