Touching a Bio is a slightly different arrangement.
I use a keyboard with a built-in USB hub (now the DasKeyboard 4C TKL) so the Yubikey is close at hand. Touching a Yubikey – such a a 5Ci – is a near automatic and completely faultless process for me now. Ping me on the bird site if you do something cool! A Small Loss Of Convenience This is not a guide, however, so expect to do some sleuthing of your own to get things set up on your particular distribution or OS. In this… review?… I’ll touch upon a few of the useful things you can do with Yubikey Bio and delve into some specific config. If I do the same with the Bio? They can’t. In short if I leave my Yubikey 5Ci plugged into a Raspberry Pi then anyone can use my private key with just a touch. Yubikey Bio takes the convenience of Yubikey and ups the ante, trading a small amount of convenience (a touch now needs to be a recognized fingerprint) for an additional layer of security. It probably wont surprise you to learn that I’m a fan. I was lucky enough for them to send me their new Yubikey Bio recently to take a look at. No key remains on the device to be found, and – since they’re unlocked by a touch, not a password – no secrets can ever be accidentally keylogged either. With a Yubikey I can connect it to the Pi I happen to be working on, and return it to my – physical! – key chain when finished. Yubikey replaced this rather cumbersome – and tremendously insecure – arrangement with a single, secure device and I haven’t looked back.
Oh and guess who has a bad habit of using the default “pi” and “raspberry” login? If you’re not, I’ll outline the issue in brief: Having keys scattered across very small, easy to go missing computers and microSD cards meant they could be pinched and though they were password protected it’s all too easy to leak that password into. I’d keep some amount of key hygiene, and trash the scattered-all-over-device ones occasionally but I think we’re probably all on the same page when I say: this was not good. Since I work across a number of devices, including many freshly provisioned Raspberry Pi’s, I tended to scp private keys between devices to save the hassle of provisioning a new one. They have become integral to my workflow. I’ve been using Yubikey products for some time now, after they hooked me up with their 5Ci and NFC.
0 kommentar(er)
