Skip to content

YubiKey hardware authentication

Background - Why - What​

YubiKey is a popular hardware authentication device developed by Yubico. It provides an additional layer of security for various online services and applications. Here are some reasons why people use YubiKey: 1. Two-Factor Authentication (2FA): YubiKey is often used as a second factor in two-factor authentication systems. It requires both something you know (like a password) and something you have (the physical YubiKey) to access an account. This adds an extra level of security, as even if your password is compromised, an attacker would still need your physical YubiKey to gain access. 2. Phishing Protection: YubiKey helps protect against phishing attacks because it requires a physical touch or button press to generate an authentication response. This means that even if you enter your credentials on a phishing site, the attacker won't be able to access your account without physically possessing your YubiKey. 3. Passwordless Login: YubiKey supports passwordless authentication, enabling users to log in to supported services without the need for a password. Instead, the YubiKey generates a secure cryptographic key that is used for authentication. This reduces the risk of password-related attacks, such as password guessing or brute-force attacks. 4. Wide Application Support: YubiKeys support a variety of authentication protocols, such as Universal 2nd Factor (U2F), FIDO2, and smart card (PIV) authentication. They can be used with a wide range of online services, including email providers, social media platforms, password managers, cloud services, VPNs, and more. 5. Portability and Durability: YubiKeys are compact and easy to carry, typically designed in a USB form factor. They are built to withstand physical wear and tear, such as being carried on a keychain. YubiKeys are also available in different form factors, including USB-A, USB-C, and NFC-enabled keys for use with smartphones. 6. Compliance Requirements: YubiKeys are often used to meet compliance requirements in certain industries or organizations where strong authentication measures are mandated. For example, government agencies, financial institutions, and healthcare organizations may require the use of hardware tokens like YubiKey to ensure secure access to sensitive data. It's important to note that while YubiKeys enhance security, they are not infallible, and it's still crucial to follow best practices like using unique and strong passwords, keeping your devices and software updated, and being cautious of phishing attempts.

Ahola Digital instructions for Yubikey​

Phase 1: All Google admin users and Management Group user must be protected by using Yubikey. Also session expiration is changed for Google auth: * Admins 2h * RED 7 days

Summary:​

  • User have 2 #yubikeys A and B. A support #NFC authentication iphone and anroid.
  • When you use Yubikey, always clearly name whatever it is. If the yubikey is lost, remove access only from that key.
  • When you enable Yubikey in Google login. Remove other login methods. E.g., sms, app, call, etc. Key A Image A Key B Image B

Instructions yubikey with iPhone IOS​

https://support.yubico.com/hc/en-us/articles/360016648979-Getting-Started-on-iOS

Instructions yubikey in Google authentication​

!!! Remember remove all other authentication methods !!! https://www.yubico.com/works-with-yubikey/catalog/google-accounts/

Other instructions​

SSH Keys FIDO2​

OpenSSH version 8.2p1 added support for FIDO hardware authenticators. FIDO devices are supported by the public key types “ecdsa-sk” and “ed25519-sk", along with corresponding certificate types. ssh-keygen may be used to generate a FIDO token-backed SSH key, after which such keys may be used much like any other key type supported by OpenSSH, provided that the YubiKey is plugged in when the keys are used. YubiKeys require the user to explicitly authorize operations by touching or tapping them. The Security Key by Yubico and the YubiKey Bio Keys support authenticating to SSH with FIDO2 credentials. Follow the step-by-step configuration instructions to enable SSH authentication with the YubiKey and FIDO2

Linux - gnome, sudo, su, etc​

Think twice before securing local tty Test twice before reboot Recover fully locked enviroment, you should have LUKS key and access to recovery usb , if not say bye, bye our local data. https://support.yubico.com/hc/en-us/articles/360016649099-Ubuntu-Linux-Login-Guide-U2F