As part of having an Ars Technica Pro++ subscription, they sent me a free YubiKey 4, which is a small hardware token that plugs into your USB port and allows for a bunch of extra security on your various accounts because you need the token physically plugged into your computer in order to authenticate. It does a number of neat things:
- Generating one-time passwords (TOTP) as a second-factor when logging in to websites;
- Storing GPG keys;
- Use as a second-factor with Duo;
And a bunch of other stuff as well, none of which I’m using (yet).
My password manager of choice is 1Password, and although it allows saving one-time passwords for websites itself, I wanted to lock access to the 1Password account itself down even further. Their cloud-based subscription already has strong protection by using a secret key in addition to your strong master password, but you can also set it up to require a one-time password the first time you log into it from a new device or browser so I’m using the YubiKey for that.
I also generated myself GPG keys and saved them to the YubiKey. It was not the most user-friendly process in the world, though that’s a common complaint that’s levelled at GPG. I found this guide that runs you through it all and, while long, it’s pretty straightforward. It’s all set up now, though, my public key is here and I can send and receive encrypted messages and cryptographically sign documents, and the master key is saved only on an encrypted USB stick. You can also use the GPG agent that runs on your machine and reads the keys from the YubiKey to also be used for SSH, so I’ve got that set up with my Linode.
The last thing I’ve done is to set the YubiKey up as a hardware token with Duo and put my Linode’s SSH and this blog (and soon Kristina’s, though hers not with the YubiKey) behind that. With the Duo Unix module, even sudo access requires the YubiKey, and the way that’s set up is that you touch the button on the YubiKey itself and it generates a code and enters it for you.
It’s all pretty sweet and definitely adds a bunch of extra security around everything. I’m busily seeing what else I can lock down now!
If you have 2x Yubikeys, you can also enrol in Google Advanced Protection: https://landing.google.com/advancedprotection/
You probably already know, but just in case: GitHub, Facebook and Bitbucket accounts can also use these keys 🙂
Ah yeah, I read about that! I don’t use my Google account for pretty much anything though (my email is all FastMail), and also don’t have 2 YubiKeys (yet). 😀
I figured I’d secure the keys to the kingdom as it were with the YubiKey, and everything else is fine with the existing TOTP saved inside 1Password anyway.