Hardware Touch, Stronger SSH

(ubicloud.com)

23 points | by furkansahin 4 days ago

7 comments

  • talkingtab 27 minutes ago
    In my opinion only, Yubico has done no favors to the Fido by their marketing. A result of trying to make Yubikey synonymous with Fido, it has become unclear what Fido does.

    And as a result of how they market their keys, decisions Fido keys are presented with a cost of $20 - $60. Why $60, for a simple Fido key? Because for $60 you get not only Fido, but Flippo, Froggo, x.6s8o and more-o.

    The result is that most people know the name Yubikey, but don't really know Fido, or what it is. On Amazon if you search for Fido you get mostly Yubikeys. There were other brands, but Yubico appears to have snuffed them. At one point there was an open source version that worked just as well as a name brand.

    As for value? If you are a big corporate type this is the cat's meow. But otherwise? What other hardware is $60? A Raspberry Pi 4? I can get little cheap USB thingies from China at 6 for a dollar.

    I am not pointing at Yubico as they have done well making profits from corporations. Rather the Fido Alliance. Looking at the Fido Alliance provides a first pass at answering the question "Who Benefits?"

    https://fidoalliance.org/overview/leadership/

    Perhaps it is fair to ask "What benefit" as well.

    Corpocracy. You gotta love it.

    • master_crab 0 minutes ago
      Most Government organizations mandate FIPS Yubikey’s that are outrageously priced.

      Yes, the $60 is clear regulatory capture. It also sets back security by raising the barrier to using these devices.

    • machinationu 24 minutes ago
      while you are right, security is generally not cheap.

      you can get that $5 china fido key, but are you sure it's you who owns it?

      I was recently looking for a security key, and eventually I did pay the yubico tax, because saving $20 by getting another one seemed unwise given the stakes.

  • solatic 28 minutes ago
    This is how you handle it as an individual developer, but in a corporate environment things get real difficult, real fast. You need to set up your VMs and Git host to only trust certificates signed by an SSH certificate authority, and you need to work with users to submit the public key from the hardware-backed key to IT (controlling the CA) to get the public key signed and a certificate issued. Establishing trust when dealing with remote workers is hard unless you have both the budget and leadership patience to pay for overnight shipping, and even then, most people don't have access to tamper-proof packaging. Furthermore, for SSH CA support, GitHub requires Enterprise Cloud, GitLab requires Premium and self-hosted instances are not supported.

    Would love to hear more from people getting this successfully set up at scale in corporate environments. I've seen big companies with lots of InfoSec talent not even attempt this.

  • simon04 1 hour ago
    Using a Token2 based id_ed25519_sk_rk key, I found very helpful to configure a different `pushurl` in `.git/config`. This allows to pull via HTTPS w/o a hardware touch.

        [remote "origin"]
                url = https://github.com/freeCodeCamp/devdocs.git
                pushurl = git@github.com:freeCodeCamp/devdocs.git
  • antonkochubey 2 hours ago
    On Apple Silicon devices with macOS 26+, SSH keys can be natively stored in the Secure Enclave, protected via TouchID: https://news.ycombinator.com/item?id=46025721

    It only supports sk-ecdsa-sha2-nistp256 key format, however that is widely supported currently.

    • XiS 2 hours ago
      Been using ed25519-sk with Yubikey for a few years now. Key is stored in KeepassXC and loaded in my SSH agent upon unlock.

      It makes my SSH key pretty portable across devices

      • throwawayqqq11 29 minutes ago
        My approach aswell. Lock down ssh-agent and restrict its usage as much as possible. Securing your keys is also very reasonable but it cant silence this naging voice in the back of my head that keeps reminding me of a compromised ssh-agent or shell, whenever i authorize privileged actions.
    • Almondsetat 2 hours ago
      You can also do something similar with any computer that has a TPM. It's unfortunate that people don't really know about it, but I guess the tools available aren't that user friendly
  • machinationu 26 minutes ago
    How will this work with agents?
    • shim__ 16 minutes ago
      That's the neat part, it doesn't
  • olivermuty 3 hours ago
    Filler pr jippo fluffer article aside, anyone tried to self host ubicloud lately? A year and a half ago it was super cumbersome, wondering if I should give it a new try now.
  • sebazzz 2 hours ago
    SSH using GPG Yubikeys and git signing using GPG was quite a process to set up on Windows a few years ago. Not something I'd want or know how to repeat. Hopefully things have improved in the mean time.