News for hackers. Stuff that matters.

A comment on OpenSSH's Support for U2F/Fido Security. Parent comment

Re:OpenSSH's Support for U2F/Fido Security by acdha on Tuesday November 05, 2019 @09:37AM (#21452698)
Not having to support the OpenSSH / OpenSC / GPG stack is a big one for me. The built-in support shipped on MacOS just works[1], Putty-CAC just works on Windows, but the OpenSC + GPG setup is semi-stable and will randomly fail in ways which require you to stop what you're working on to kill daemons or unplug/replug the device to get it working again. I would not want to support anything involving that stack.

1. The Yubikey docs describe the pre-Sierra process — https://support.apple.com/en-us/HT208372 has what most people will want to use after 2016. See https://github.com/Yubico/developers.yubico.com/issues/197.

[ Parent | on HN ]
Re:OpenSSH's Support for U2F/Fido Security by GhettoMaestro on Tuesday November 05, 2019 @10:06AM (#21452981)
This!

Setting up a yubikey via gpg to be an agent for ssh was such a pain at least 2 years ago.

[ Parent | on HN ]
Re:OpenSSH's Support for U2F/Fido Security by knorker on Tuesday November 05, 2019 @12:49PM (#21454701)
The PIV/OpenSC way work absolutely perfectly for me. Even on Windows.
[ Parent | on HN ]
Re:OpenSSH's Support for U2F/Fido Security by GhettoMaestro on Tuesday November 05, 2019 @01:17PM (#21455028)
Interesting. I had so many issues with the SC daemon on Mac that I eventually just gave up and reverted to keeping my local ssh key in ~/.ssh/ with a passphrase on it.
[ Parent | on HN ]
Re:OpenSSH's Support for U2F/Fido Security by zchrykng on Tuesday November 05, 2019 @10:11AM (#21453033)
Still is. Just randomly fails.
[ Parent | on HN ]