This isn’t strictly a privacy question as a security one, so I’m asking this in the context of individuals, not organizations.

I currently use OTP 2FA everywhere I can, though some services I use support hardware security keys like the Yubikey. Getting a hardware key may be slightly more convenient since I wouldn’t need to type anything in but could just press a button, but there’s added risk with losing the key (I can easily backup OTP configs).

Do any of you use hardware security keys? If so, do you have a good argument in favor or against specific keys? (e.g. Yubikey, Nitrokey, etc)

    • KillingTimeItself@lemmy.dbzer0.comEnglish
      3·
      3 months ago

      i’m honestly not to sure how one would go about it, i know one of my friends has done it. I would assume there is at least one open source project for this type of thing. Realistically i can’t imagine it would be that hard, there are probably writeups on people doing it already. In the most simplistic form you’re keeping spicy private keys on an encrypted flash drive. That way they’re a physical hardware item, but also physically isolated. Though you would absolutely be in a bit of a bind if you ever lost it. Realistically, changing the key and it’s encryption will solve that problem though.

      I’ve recently thought of doing similar things using forward secrecy keys stored on the flashdrive itself so that way it’s always different. Similar immediate security risk there, but again changing the key is the solution. Theoretically you could also do a two part key system, where you store a portion of it on your system, and the rest on the drive, so that way in the event of compromise, they only have a portion of the key. And they still need the other part in order to do anything.

      scripting wise, it should be pretty simple, you plug in the drive, automount it, rip the key out, stuff it to where it needs to go, and then remove the drive. Always make sure you have secondary backups though, whether written down or stored somewhere. Losing accounts is no fun.

      I’m not a security researcher or expert though, there are definitely smarter people out there that have already talked about this kind of thing at length.