Re:Google: Security Keys Neutralized Employee Phishing
by klodolph on Monday July 23, 2018 @10:16AM
(#17592914)
Yubico Fido keys (Security Key by Yubico, the blue ones) only support FIDO U2F. This lets you use them for logging into GMail, DropBox, and other websites which support FIDO U2F. You can't store passwords or other data on them. This means you can't use them for storing SSH keys or things like that. There's not some technical reason why you can't use FIDO U2F for SSH authentication, it's just that the software support isn't there yet. You could probably hack this together yourself, the idea would be that you generate a SSH key on your computer, authenticate to some certificate manager with U2F, and then use that to install the public key on the computers you want to access. You could then have it automatically expire 8h later, forcing you to reauthenticate, giving attackers a shorter window to compromise your machine if they want to hop to others with SSH.
[ Parent
| on HN ]
There are no comments on this comment yet.