A permanently attached Yubikey is not worse than a password alone, and is still superior to SMS 2FA. It still requires that an attacker know both your password and have physical possession of your machine. For the vast majority of users, this is sufficient protection from the threats that they face. The chance that someone both knows your password and is close enough to steal your yubikey is incredibly unlikely.

If you’re the kind of person liable to get personally targeted for nation state level attacks, then you definitely are going to want to unplug your yubikey and keep it on your person. For the rest of us, a hardware 2FA token is enough to protect against a sim swap attack, which is probably enough.

> Yubikeys are great for security, but not when you leave them in your computer unattended. At that point, anyone can take the key and use it for 2-factor authentication/SSH/GPG signing, so it’s not much better than just using a normal password.

Even after the edit at the top regarding PIN it still seems to not get the main point of a U2F token: It's physical. It's incredibly hard to extract secrets from it. It's local to where it physically is.

If I have a password then there are probably a couple of services and people that could reasonably get to it either by hacking the service the password unlocks (in storage if its a really insecure service or in transit the next time I log on), or can extract it from my password manager/memory/browser or whatever.

The point of a U2F token for me is to change the number of people who can reasonably authenticate as me from "everyone who has my password" to "everyone who have a physical key I keep within a reasonable distance from me that is incredibly hard to copy and has my password". U2F also validates auth origins quite a lot better than many other methods, although I guess that is not relevant to this argument.

A hardware U2F token is not the end-all be-all security, but it reduces potential attackers a lot.

Seems like a bad idea. Requiring a touch means it's much harder to trigger the key through software alone -- or maybe impossible. So someone has to actually be present at the machine. This is particularly important when, for whatever reason, the machine you can actually put your hands on is actually a gateway to other machines. You can ssh tunnel all you want, but somebody still has to physically touch the key for it to authenticate. Naturally, that only works if you authenticate at each level, and if you do not trust other levels.

The way we use them at Google, the keys are associated to particular machines and human accounts. You can't just remove a key from one machine and stick it into something else. It is the combination of the machine and the key that is enabled. A key can be deregistered/wiped, and assigned to a different machine...but you need to be properly logged in to make that happen. In the context of a corporation that is relatively straightforward, but perhaps for personal use it is less so. Actually, without the right infrastructure in place, it's quite likely to be a lot more complicated.

This is really cool, but I still feel betrayed cause when I read "touchless" and "contactless" I thought this was gonna use NFC

Some time there was a similar tool that locked the computer via bluetooth if you walked away from the desk with your phone. It didn't unlock it which is fine, but it seems a better way to lock a computer if you forget rather than a timed screensaver after x minutes which leaves the computer vulnerable until then. (Mostly just from colleagues changing your wallpaper, or autocorrect...)

Sounds good, but I'd really want to use a PIN with that. Otherwise anyone can take my key and walk up to the computer and unlock it.

I wonder if there is something like pam_piv? I use PIV already for Mac & Windows... Suppose I should look for it myself :)

I think the concept is really cool and it’s awesome that Linux makes it relatively easy to play around with authentication methods. I love this kind of stuff.

But I’m also a pragmatist. While I run Linux everywhere I reasonably can, my daily driver is macOS and I can’t help but wonder if a fingerprint reader would be a better solution.

On my Mac, the fingerprint reader can unlock the system immediately and works across the operating system for root access, including sudo. (There’s a pam module.)

Locking can be done OS-wide using a keystroke (Cmd+Crtl+Q), touchbar button, or by closing the lid.

Windows has had similar capabilities far longer than macOS.

Thanks everyone for the feedback on Yubikeys being stolen! I've tried to summarize it all in a footnote, and downgraded the severity of my original starting paragraph. Thanks for reading!

The main drawback of this method if used daily would be broken USB ports.

BTW, here is a handy way to quickly generate GPG keys (and set up git commit signing and SSH key derivation) on Yubikey: https://github.com/DataDog/yubikey

So anyone can take my Yubikey and use it to gain access to my computer without so much as a PIN? Is that a good idea?

PIV certificates are kinda meant for this

i wonder if this would work for Active Directory logins which my AD connected linux laptop does

I stopped reading at the first paragraph: "At that point, anyone can take the key and use it for 2-factor authentication/SSH/GPG signing, so it’s not much better than just using a normal password.".

If the author hasn't figured out you can assign a PIN to the keys you store on the Yubi, then I don't see why I should waste my time reading their rambling blog post.

Good luck taking my Yubikey and trying to SSH to my kit. Won't do you much good without the PIN that is in my head. ;)

P.S. You can also configure the Yubi to lock and mandate a PUK after too many wrong PINs.

This is a great idea!

Hey author, why did you use the words "touchless" and "contactless" when it's not true and not even relevant to the technology being used?

There's something strange going on here, like this article was written by AI or something. It's using words out of context, or just making plainly/obviously false statements.

In this context it's probably better to think about them as FIDO/ CTAP tokens rather than as U2F (which is obsoleted by WebAuthn and focused on the Web) or, as the author does, just narrow it explicitly to Yubikeys and not the wider menagerie of similar products. Yubico's own Security Key implements FIDO2 (and so could also be used for U2F) but won't work for the author's approach.

Anyway, the main thing I wanted to mention is that the use of public key encryption means this is quite different from the device having "my password". Even in the on-device ("resident credential") scenarios the authenticator doesn't have a password which is a shared secret, it actually has a private key which it won't divulge - much better.

Implementation errors by a web site can leak your password, which because it's a shared secret can then be used by adversaries to log in. It's impossible to be sure a site didn't get this wrong, even if you're confident they are competent and well meaning.

In contrast the WebAuthn (and U2F) design doesn't give sites enough information to impersonate you even if they wanted to, only to authenticate you. This is a familiar pattern from public key cryptography, receiving the certificate for news.ycombinator.com allows me to verify this is news.ycombinator.com but not impersonate them. Likewise, when you enroll a FIDO authenticator to use Facebook, Facebook doesn't learn how to impersonate you, even on Facebook, only a way to verify that you still have that authenticator. [And the design is even more careful, it uses completely independent credentials for each site, so when Microsoft bought GitHub they actually could not merge the FIDO-based authentication between GitHub and Microsoft properties, even if they thought that was a good idea it's deliberately impossible. ]

Honestly the threat of someone cloning the key is so minor that a USB stick is probably enough. If someone goes through the effort to make fake a USB stick with the right hardware ids then I've got way bigger problems.

As a daily user of Linux for the best part of a decade I'm curious where Linux falls short for you?

> If the author hasn't figured out you can assign a PIN to the keys you store on the Yubi, then I don't see why I should waste my time reading their rambling blog post.

Try being a little nicer. If you feel that the blog post is a waste of your time, here's a revolutionary idea – don't say anything? There are 29 other posts on the front page, maybe one of those other ones will be worth your time.

As it is, the UX of the poster's solution is totally different from yours; it enables a one-time, contactless authentication during login. Yours requires a ton of manual input every time the Yubikey is used for SSH. There is some different in the security models here, but the author's solution is broadly different from yours, and to me, much more convenient (I use a Yubikey with a PIN for work and it's kind of a pain).

Author of the post here - you have a good point with regard to SSH/GPG. (I do have a PIN on my keys.) I was targeting more the U2F standpoint - as in if you're using it for 2FA, it's obviously no better than a password if someone else can just press the little yellow button :)

Thanks for reading, though, and for commenting!