[{"data":1,"prerenderedAt":338},["ShallowReactive",2],{"project-23130053":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":35,"aspects":36,"strip":40,"post_text":43,"what":44,"said":69,"maker_in_thread":178,"shape":181,"grid":186,"attempts":301,"same_week":302,"maker_shows":183,"maker_hidden":331,"reader_version":332,"card":333},"23130053","Yubikey-agent","an easy to use Go ssh-agent for YubiKeys","title","Show HN: Yubikey-agent – an easy to use Go ssh-agent for YubiKeys","https:\u002F\u002Fgithub.com\u002FFiloSottile\u002Fyubikey-agent","github.com","FiloSottile",1589080767,2020,152,52,395,3028,14,"notable","security_privacy","hardware security key ssh agent","cli",[24,25,26,27,28],"yubikey","ssh agent","piv","hardware key","gpg","curious",-0.05,{"positive":32,"neutral":33,"mixed":32,"critical":34},1,6,2,10,{"idea":37,"execution":39},{"positive":32,"critical":38},0,{"positive":38,"critical":34},[38,38,38,38,38,38,38,38,38,38,38,38,38,38,38,38,38,41,41,42,41,38,32,38,38,38,38,38,38,41,38,41,32,41,38,38,38,38,38,38],3,5,null,{"problem":45,"audience":43,"pricing":43,"motivation":56,"time_to_build":43,"stack":61,"openness":67,"stage":68,"team_size":68},{"value":46,"source":47,"evidence":48},"Using YubiKeys for SSH authentication is hard to set up","inferred",[49,53],{"id":50,"by":51,"text":52},"23130757","m3nu","I use it with PKCS#11 mode and can't confirm some of the drawbacks the author mentions under Alternatives: > The UX of this solution is poor: [...] and needs manual reloading…",{"id":54,"by":11,"text":55},"23134218","It surely depends on the OS, and on the PKCS#11 implementation. I tested ykcs11 and OpenSC on macOS and they were like I described. I had started this project as a simple setup…",{"value":57,"source":58,"evidence":59},"Maker built a graphical-pinentry agent because PKCS#11 setups were poor UX","maker",[60],{"id":54,"by":11,"text":55},[62],{"value":63,"source":58,"evidence":64},"Go",[65],{"id":66},"post","open_source","unknown",{"praise":70,"objections":90,"requests":116,"questions":131,"alternatives":146},[71,83],{"value":72,"source":73,"evidence":74},"Native OpenSSH FIDO keys are convenient and simple to set up","commenter",[75,79],{"id":76,"by":77,"text":78},"23131979","stavros","I have been trying to use Yubikey for SSH over the years, and everything has been a huge hassle that just didn't work well enough. Everything, that is, until SSH 8.2 came out.…",{"id":80,"by":81,"text":82},"23132939","exabrial","Ok so this is neat; while the newest openssh client\u002Fserver directly supports u2f keys, this is a badass shim that creates NIST-p256 compatible keys that are backed by a…",{"value":84,"source":73,"evidence":85},"PIV-based approach keeps PIN protection, unlike new OpenSSH security keys",[86],{"id":87,"by":88,"text":89},"23135354","fhenneke","The new OpenSSH keys are very convenient if used correctly, but have a crucial disadvantage compared to the PIV-based approach of yubikey-agent: They currently can't be protected…",[91,98,105],{"value":92,"source":73,"evidence":93},"Native OpenSSH FIDO keys lack effective PIN protection",[94,95],{"id":87,"by":88,"text":89},{"id":96,"by":88,"text":97},"23135993","The tokens are engineered to protect the private key material stored inside them very well, so you can be quite certain that nobody will ever be able to log in without physical…",{"value":99,"source":73,"evidence":100},"Does not work with GitHub SSH yet",[101],{"id":102,"by":103,"text":104},"23136281","frutiger","> Do you know if this already works with GitHub? It does not. From an `ssh -vvv git@github.com -i \u003Cpath\u002Fto\u002Fsk key>` session: ``` debug1: Next authentication method: publickey…",{"value":106,"source":73,"evidence":107},"Older server distributions lack OpenSSH 8.2",[108,112],{"id":109,"by":110,"text":111},"23133468","veeti","> The downside is that both sides have to be running SSH 8.2+. This is the problem. I was really excited for FIDO SSH keys, but LTS server distributions don't support it so it's…",{"id":113,"by":114,"text":115},"23133693","411111111111111","Half of our servers are Ubuntu 14.04, the rest 18.04. I'll wager that it's not gonna be in either of these releases. You should specify which lts you're talking about with a…",[117,124],{"value":118,"source":73,"evidence":119},"Support for multiple keys or backup YubiKeys per SSH key",[120],{"id":121,"by":122,"text":123},"23132156","brazzy","Can you register multiple devices for the same SSH key, so you have a backup in case one gets lost or breaks?",{"value":125,"source":73,"evidence":126},"Integration with GnuPG scdaemon to sign and encrypt",[127],{"id":128,"by":129,"text":130},"23132464","bonzini","Would it be possible (or would patches be accepted) to talk to the GnuPG scdaemon instead? This would let me use gpg-agent to sign and encrypt.",[132,139],{"value":133,"source":73,"evidence":134},"How to back up the key to another YubiKey",[135],{"id":136,"by":137,"text":138},"23138454","teruakohatu","Sounds really easy but how do you backup this key to another Yubikey? Or do you simply have two, and always add two keys to each server?",{"value":140,"source":73,"evidence":141},"Whether SSH keys work with AWS",[142],{"id":143,"by":144,"text":145},"23132911","ithkuil","Can such a key be used as an aws key?",[147,158,163,174],{"value":148,"source":73,"evidence":149},"gpg-agent",[150,154],{"id":151,"by":152,"text":153},"23132568","danieldk","I use gpg-agent, but I agree it is often a pain. I will probably switch to U2F + SSH once more servers have OpenSSH 8.2. Do you know if this already works with GitHub?",{"id":155,"by":156,"text":157},"23130966","jopsen","Hmm, gpg-agent has worked nicely for me. The biggest pain is that I have to reconfigure when I switch yubikey. (Yes, I have multiple keys with the same gpg key on each)",{"value":159,"source":73,"evidence":160},"PKCS#11 with ykcs11 or OpenSC",[161,162],{"id":50,"by":51,"text":52},{"id":54,"by":11,"text":55},{"value":164,"source":73,"evidence":165},"Trezor or OnlyKey",[166,170],{"id":167,"by":168,"text":169},"23141185","urza","You can also use Trezor.io instead of Yubikey for ssh login. https:\u002F\u002Fblog.trezor.io\u002Fopenssh-with-fido2-and-trezor-e565c2277 Advantage of Trezor is that it has better backup…",{"id":171,"by":172,"text":173},"23130994","fidelramos","I want to mention a Yubikey alternative that runs on open-source firmware and software: OnlyKey [1] It has an onlykey-agent that works as an SSH agent [2]. It doesn't work as a…",{"value":175,"source":73,"evidence":176},"OpenSSH FIDO2 keys (ssh-keygen -t ecdsa-sk)",[177],{"id":76,"by":77,"text":78},{"comments":32,"answered":38,"key":179},[180],{"id":54,"text":55},{"commenters":182,"max_depth":183,"maker_replies":32,"first_comment_mins":184,"lifespan_hours":185},28,7,204,276,[187,189,191,194,196,199,200,202,203,204,206,208,209,211,212,214,217,219,222,224,226,227,229,231,233,235,237,239,243,247,249,251,254,256,258,260,262,264,268,270,274,277,280,281,283,285,287,289,291,293,295,298],[76,38,38,188,77,38],"other\u002Fneutral\u002Fnone",[121,38,38,190,122,38],"commenter\u002Fneutral\u002Fnone",[192,38,38,190,193,38],"23132166","StavrosK",[195,38,38,190,122,38],"23135273",[197,38,38,190,198,38],"23132172","justincormack",[151,38,38,188,152,38],[201,38,38,188,193,38],"23132903",[102,38,38,188,103,38],[143,38,38,188,144,38],[205,38,38,190,193,38],"23132949",[207,38,38,188,144,38],"23134310",[109,38,38,188,110,38],[210,38,38,190,193,38],"23133490",[113,38,38,190,114,38],[213,38,38,190,193,38],"23133716",[215,38,38,188,216,38],"23259235","krabelize",[87,38,38,218,88,38],"other\u002Fneutral\u002Fprivacy",[220,38,38,221,193,38],"23135375","commenter\u002Fneutral\u002Fprivacy",[223,38,38,218,88,38],"23135598",[225,38,38,221,193,38],"23135658",[96,38,38,221,88,38],[228,38,38,221,193,38],"23136776",[136,38,41,230,137,38],"project\u002Fneutral\u002Fidea",[232,38,41,230,193,38],"23138537",[234,38,38,188,168,38],"23141194",[80,32,42,236,81,38],"project\u002Fpositive\u002Fidea",[50,34,41,238,51,38],"project\u002Fmixed\u002Fexecution",[240,34,38,241,242,38],"23131436","commenter\u002Fneutral\u002Fexecution","Boulth",[244,34,32,245,246,38],"23131765","project\u002Fcritical\u002Fexecution","DCKing",[54,34,38,248,11,32],"maker\u002Fneutral\u002Fexecution",[155,41,38,250,156,38],"other\u002Fneutral\u002Fexecution",[252,41,38,190,253,38],"23130998","noodlesUK",[255,41,38,190,242,38],"23131460",[257,41,38,188,156,38],"23136480",[259,41,38,188,242,38],"23133589",[261,41,38,188,156,38],"23136533",[263,41,38,188,242,38],"23143712",[265,266,41,230,267,38],"23131429",4,"abricot",[269,266,41,230,51,38],"23131478",[271,266,38,272,273,38],"23142259","other\u002Fneutral\u002Fdocs","sebazzz",[275,266,41,230,276,38],"23132185","brippalcharrid",[278,42,32,245,279,38],"23134385","xaduha",[167,33,38,188,168,38],[128,183,41,282,129,38],"project\u002Fneutral\u002Fexecution",[171,284,38,188,172,38],8,[286,284,38,188,152,38],"23131039",[288,284,38,188,172,38],"23131257",[290,284,38,188,193,38],"23131962",[292,284,38,188,172,38],"23132184",[294,284,38,188,193,38],"23132261",[296,284,38,188,297,38],"23132680","jabart",[299,284,38,188,300,38],"23193308","cr7pt0",[],[303,308,313,318,323,327],{"id":304,"name":305,"points":306,"category":307},"23165333","SHA-256 Animation",1053,"learning_science",{"id":309,"name":310,"points":311,"category":312},"23169962","This Word Does Not Exist",956,"ai",{"id":314,"name":315,"points":316,"category":317},"23114103","Twitch Roulette",732,"consumer_social",{"id":319,"name":320,"points":321,"category":322},"23126458","Lite",607,"dev_tools",{"id":324,"name":325,"points":321,"category":326},"23157408","Scan Your PDF","productivity",{"id":328,"name":329,"points":330,"category":326},"23101869","HPI",478,false,"v2",{"id":334,"name":5,"line":6,"ai":331,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":30,"top":18,"kw":335,"maker":11,"domain":10,"tier":19,"attempts":38,"strip":336,"url":9,"mix":337,"praise":72,"objection":92,"sub":21},23130053,[24,25,26,27,28],"0000000000000000033530100000030313000000",[32,33,32,34],1793991009122]