Yubikey: Powerful Security Made Painfully Simple

Links Mentioned!
+ www.linode.com...
+ forum.level1te...
**********************************
Thanks for watching our videos! If you want more, check us out online at the following places:
+ Website: level1techs.com/
+ Forums: forum.level1tec...
+ Store: store.level1tec...
+ Patreon: / level1
+ KoFi: ko-fi.com/leve...
+ L1 Twitter: / level1techs
+ L1 Facebook: / level1techs
+ L1/PGP Streaming: / teampgp
+ Wendell Twitter: / tekwendell
+ Ryan Twitter: / pgpryan
+ Krista Twitter: / kreestuh
+ Business Inquiries/Brand Integrations: [e-mail]
IMPORTANT Any email lacking “level1techs.com” should be ignored and immediately reported to [e-mail].
-------------------------------------------------------------------------------------------------------------
Intro and Outro Music By: Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 3.0 License
creativecommons...

[@rudyossanchez]

Hairless Wendell is in my top 3 favorite people in this channel

[@Level1Techs]

Ok, you got me, this made me laugh xD ~Editor Amber

[@dgnikon]

@@Level1Techs you definitely are in my top 4 favourite people in this channel, amber!

[@tsuzot8192]

*Grumpy Hairless Wendell

[@bw_merlin]

This is the first time I have ever seen Krista and Ryan actually physically next to each other. I just assumed there was a HR mandate that they be one Wendell distance apart at all times.

[@JohnClark-tt2bl]

Lol Ryan's answer to security is to live alone. 😂

[@irvingchies1626]

He doesn't even trust his own cats bruh

[@anarekist]

He's not wrong

[@Bob_Smith19]

He’s 100% right. Anyone that’s had a family member steal something will tell you the same.

[@Silverhks]

@@irvingchies1626 never trust your cats. They are just waiting on you to be still looking enough to be eaten.

[@urmensch12]

Krista being back in the Office is the best news i have gotten all week.

[@WafflesOinc]

Yes! We missed her

[@nekomakhea9440]

"Are you suggesting people kill their family?" Well, it *is* getting to be that time of year...

[@Stoney_Eagle]

Look who's finally back 🙌🙌

[@Stoneheadification]

Now i only need to increase my stock of laxatives and i'm finally safe and encryped enough for the family reunion...

[@frankcastle5737]

They make enemas, too😌😌js

[@GabdaG]

@@frankcastle5737 and stretchers, for easier acess.

[@AM-dc7pv]

Ah, yes, the good ol' coconut oil trick. Works 75% of the time, every time.

[@frankcastle5737]

Toothpaste. May, as well smell minty from top to bottom.

[@frankcastle5737]

@Patrick G DTA cant be compromised.

[@LukasEragon]

DTA joke at the end a 12min add. lol Love it!

[@MichaelSmith-fg8xh]

Funny how multiple tech channels spontaneously remembered their love for YubiKey in the same week...

[@choiceschoices5910]

LOL CHRISTA'S HEAD-SHAKING, HAHAHAHA

[@kill3r3k]

More Ryan hands-on videos please :)

[@jacobpfeifer6198]

I currently use a yubikey for ssh but my preferred method is to use its pgp functionality. You can basically setup ssh to use the gpg-agent for auth then add the public pgp key to the server. Once you do that you can use the yubikey as the ssh pgp key instead of a typical rsa key. A couple things to note is that you still need a pin to unlock the pgp functionality on the yubikey which completes the something you know part of something you know and something you have. The biggest issue with this setup is that by default the yubikey doesn't require a physical touch to the key to use the pgp cert. This means that a keylogger could grab the pin and input it automatically. Fortunately there's a setting on the yubikey to require physical touch for pgp operations. Another nice thing about this is it's compatible with pgp password vaults such as pass. There's also the advantage that you can keep a copy of the master pgp key on an sd card locked up somewhere as a backup in case something happens to your yubikey

[@denisruzicka1606]

I think this should be preffered because then you don't have to use Yubico online service and upload your secret key there.

[@InAUGral]

Been using one for years and am surprised they didn't take off more than they have. Yubikey Neo is where its at. Mix of USB and NFC is very handy.

[@olo398]

ayyy teh crews back! lets go~!

[@zackyd666]

I had a yubikey hit by a lawnmower, left out side in the snow for 3 days and it still works (I dropped by keys, apt staff mowed, and then it snowed, and I found them when the snow melted)

[@marcelliusika]

Having Kreestuh and pgpryan outside the usual News is always refreshing. #Level2Techs

[@eXsoR65]

This is GOLD! Thank you! I recently got a Yubikey but was not aware it can be used with ssh.

[@tommihommi1]

ah yes, nothing better to prevent access from someone in your home than a physical dongle that you keep in your home

[@CausticLemons7]

Legitimately can't tell if the ending is serious. Great job!

[@IAmPattycakes]

Agents Toast and Crouton are just waiting til Ryan runs out of coconut oil.

[@swoop8047]

While I love tinkering with all sorts, I find myself shying away from trying out authentication since I don't know enough to get myself out of a pinch. :D Must be a nice feeling to understand it all.

[@Unfamiliar_Fruit]

I use a Yubikey and I don’t understand the complexities of cryptography. I’m not sure anyone who isn’t regularly involved with the RSA fully understands modern digital cryptography.

[@MarkRose1337]

That was a great video tutorial!

[@Level1Techs]

Glad you liked it! ~Editor Amber

[@jamesprine8565]

Christa what are you doing 🤨? Decided to get out living on the edge 🤣🤣. Just messing with you glad to see your back!

[@jinx0192]

My password 1234 never has failed me. Also PASSWORD works great too!

[@steven44799]

I use incorrect as my password, that way when I forget it or get it wrong most things just tell me what it is without having to do a password reset. Big brain thinking.

[@tin2001]

@@steven44799 One of my friends in high school had his home computer password guessed by his sister... He changed it while yelling at her, and she said "I'll just guess it again".... So he made it "you won't".

[@Outland9000]

yay... The old background music is back!!!

[@dreamer77dd]

Love the beginning, and then things went over my head fast.

[@DriftaBeatz]

I've been on the yubikey 🚆 for years no issues

[@MaxSnip3s]

Currently trying to implement a mix of YubiHSM & Yubikeys for a thesis. And god damn, they have some of the most lackluster documentation I've seen yet.

[@dawidskibinski3027]

Slight correction guys - OTP stands for One Time Pad, not password, which is information-theoretic secure key protocol, meaning in practice that the key is completly random generated and the lenght of message that it is going to cypher and propability of cracking it is equal to guessing the message. Real useful stuff when you are afraid of someone accessing your data and have real RNG at hand, though to my knowledge even some high end quantum RNGs are not in fact truly random and thus it is still possible to crack it, although more in theory than practice. Anyway nice seeing something useful to the ressistance after quantum computers send their robot army on us.

[@Brayden421]

My Yubikey went through the laundry recently and survived so they aren't completely hopeless around water. I wouldn't do it every day though and I bought two (and enroll both where possible) so there's a backup regardless.

[@bkoch53]

a wonderful 12 minute ad, ty. we all know there are other OTP, 2FA hardware keys out there that are better.

[@greytimberwolf68]

Thumbs up just for the last part of the video. security is everything. 😂

[@brandonpfister]

Ryan's humor just slays me! Hahahaha!

[@Darkn3ssF4ll]

Sorry for the noob question. You had to put these values for client and secret in the clear ? Just trying to wrap my head around what I'm looking at there and what someone could do with it?

[@samuelschwager]

Engagement challenge completed.

[@Im1CrazyCow]

The Ending was Priceless !!! Prison Wallet 🤣🤣🤣 !!! Cow}:-o)

[@JuanLopez-db4cc]

Great Video! Thanks.

[@Level1Techs]

So glad you liked it! ~Editor Amber

[@SiimKuusik]

Wendell's laugh at the end 😅

[@RyTrapp0]

Might not be a bad idea to get a 'Tile' for this thing if you fully commit to this - you know, just in case the wrath of bad luck just so happens to strike your ass...

[@3vil8unny]

Sorry I cant reach ill need Ryan to help me hide it everytime....love this guy

[@Mrperfectwoo]

Windows Key + L. Learn it and build the muscle memory for when you walk away from your desk.

[@Brayden421]

Yeah it's an obsession with me as at my first job (service desk) if you left your PC unattended and unlocked they'd ruthlessly mess with it.

[@Mrperfectwoo]

@@Brayden421 exact same for me haha!

[@amahashadow]

^THIS. Also, if you always have your phone with you, you can configure Windows to autolock using Bluetooth, but it does require a BT dongle, and for your phone to always be connected. It has failed me a few times, but it's still nice to have if you forget to manually lock it. Also Also, 2 min screensaver with mandatory auth when woke up

[@dougm275]

I've been thinking about a way to access my homelab when I'm at school, the idea makes me kind of nervous, but I think a mix of a Ubikey and a small Linode instance might do it.

[@sy5tem]

i love to over complicate myself with that kind of password method, especially when 99% of the time its a software flaw that is a security hole in my systems. at least i fell secure ...

[@ArodiCruz]

Whoever disliked this undercooked their pizza rolls

[@ZenAdm1n_]

Can you remake a version of this video that would be appropriate to share with coworkers? Thanks.

[@pkt1213]

I just have a lock and a child proof handle on my server room. Has kept my kids out so far.

[@Derbauer]

This was hilarious and very informative, thanks guys 👍

[@oldschool1079]

for elephant in the home just use Veracrypt or Bitlocker if you are stuck in the corporate environment.

[@nadiasmith3262]

It's all about timing in comedy and these guys have it. --> DTA

[@lancervi1762]

"teenagers will sell you out for an xbox and a dime bag of weed!" Ain't that the truth. I raised two of them and survived.............barely!

[@NomenNescio99]

Why not just use the yubi key to store your ssh key instead?

[@Mr.Leeroy]

expected some overview of how it actually works, got "execute this", "following by that".

[@Dannicus117]

was looking into this stuff yesterday. small world

[@frankcastle5737]

K: who hurt you? Me:🤣🤣💀

[@devdhamija7585]

My prison wallet is full. I'm going to have to make some room first.

[@bret44]

Why can’t I do this natively in windows without entering a password or scanning a finger? I would like to be able to just insert a usb drive to login to my work computer without crappy extra software in my system tray. Yubikey please make this happen and I will buy tons of your keys.

[@jacobpfeifer6198]

This actually used to be a thing but microsoft got rid of the api for it

[@cj37373]

Now my biggest fear is loosing my yubikey

[@kojack57]

Prison wallet. Where did Ryan pull that line out of. It's a good one but not as good as Krista's genuine concern. Oh and by the way, interesting product. I'll be checking this out for sure. The pass word protected public/private key thing does make me feel a little too smug.

[@LucaDigioia83]

awesome

[@SportsIncorporated]

Ryan. Before today, he was always the guy on the right.

[@steen8156]

Still chuckling after three minutes. The chrome one missed his calling.

[@jawsthemeswimmin]

1:08 it almost seems like Krista comes to life after Ryan mentions the dime bag 😂😂

[@truthseeker3907]

Thumbs up! 👍

[@DanielLiljeberg]

I have authelia with Yubikey/Duo Mobile authentication protecting all my public facing services. I'm thinking of adding it to local access and be able to run sudo commands, but I want at least one more Yubikey as backup before I do that :)

[@xmlthegreat]

Yubi yubi yubi! Korone Inugami will be very interested in this.

[@hinrek]

so you are saying that linode is self hosting and linode admins cant access your data if they want to?

[@sharkbytefpv4326]

Coconut oil... a very specific advice....^^

[@cbot4211]

What if the device has a virus, malware, and you connected the Ubikey and corrupted the ubikey?

[@robertnees9781]

Prison Wallet 👀 (as something not involving 🥥 oil, how about a vid showing Yubikey for Windows, website logins, mobile (NFC), ... )

[@techkenX]

he's said a dime bag of weed-like bro where did you learn that from

[@martinusmagneson]

Did you just trick me into watching a 12 minute ad for a dongle?! You could have had candy instead!

[@Pienimusta]

How about NFC as two phase? I remember at least Asus selling those pads you could use for login.

[@Parafilm1337]

Looking exceptionally bald today. I'm liking it.

[@Level1Techs]

You got a good chuckle out of me xD ~Editor Amber

[@nateedwards1313]

Black text on white background what decade is it?

[@uss_liberty_incident]

Good to see you back behind that desk Krista!

[@VorpalGun]

Ouch, so this is tied to YubiKeys servers being up and reachable? Thanks but no, I want a fully self hosted solution.

[@xplinux22]

Agreed. I don't really understand why they went this route for this tutorial. See this tutorial instead for an API keyless solution which simply uses PAM U2F for authentication (GDM, TTY, and SSH auth): kzbin.info/www/bejne/ppe5mXSqf9loldE

[@Bunjamin27]

I always laugh/cringe when knowledgeable people want to explain something “painfully simple” because it never fucking is. Still lobbying for level 099 techs!

[@chaython]

4:40 What microphone is that? I love the bass!

[@b2bb]

this video was fuckin great

[@Level1Techs]

Thank you! ~Editor Amber

[@marcelomafra]

Awesome!

[@Level1Techs]

Thanks! ~Editor Amber

[@sounakmondal3342]

The teenager bit tho😂

[@hiddenlawyer]

So what you are saying when it comes to security, we are all going to take in the ... either way.

[@Hadw1n]

Great!

[@spuchoa]

DTA foreva!

[@TrueThanny]

Why are you using 'sudo' when you're logged in as 'root' already?

[@ozlicious9902]

They are probably making sure that users don't run into problems when not logged in as root. Although, there are differences between root and commands run as sudo.

[@olbaze]

YUBI YUBI!

[@TradeSomeGameSome]

I was laughing so hard at the "Prison Wallet" comment that my wife came in the room to see if I was OK. I said "I am, not sure about this guy on KZbin"

[@Level1Techs]

Haha! ~Editor Amber

[@dunastrig1889]

Woot!

[@Arakox]

video starts at 1:42

[@martinlutherkingjr.5582]

Why not just lock your computer when you go to the bathroom?

[@1337voltronBOT]

Did you do a tear down to make sure there isnt russian or chinese or , even worse, american spy tech inside that thing!1?? 😨

[@magicguirarman]

I'm pretty sure my "prison wallet" puckered at the end.

[@doxydoxdelamanca9902]

Christa, Krista, Crista...pls wear your glasses!

[@Level1Techs]

Ikr, and it’s Krista :) ~ Editor Amber

[@DarioCruzII]

We issue these to all the managers at Amazon. Damn shame that always lose the damn things.

[@kaspersergej]

Fantastic humor 😄😄

[@Level1Techs]

Glad you enjoyed it! ~Editor Amber

[@PaulRitzkat]

What's the ssh client your using?

[@user-su4mt1zb1q]

seems to be the default ssh client on another linux VM, so probably openssh

[@PaulRitzkat]

@@user-su4mt1zb1q should've phrased it differently, whats the name of the terminal :D

[@CodyHodges]

Looks to be a paid product called xshell.

[@mikej2239]

Coconut oil for the win!

[@YorHighness]

Where is Wendall?

[@Pienimusta]

Toast would sell Ryan to Chinese for some catnip.