2y ago

Question for security enthusiasts

so ive been looking into a Yubikey because i want 2FA on all of my accounts. however on yubicos website it says it supports linux. but the documentation is confusing and i want the Authentication app to setup my Yubikey on my main OS (NixOS) it seems that yubico only supports ubuntu, which i tried using in distrobox but with no success. so i looked on flathub and found this app however it gets me kinda spooked that the app is made by the community. is it safe to use my yubi key with? and if not does anyone have any idea how to compile from source, which btw im kinda a noob at compiling from source which i know is ironic because i run nix.

link to flathub application https://flathub.org/apps/com.yubico.yubioath

11 comments

If you're dedicated to YubiKey, that's fine, but I strongly suggest Open Source and Open Hardware implementations of security keys, such as SoloKey.
SoloKey supports Linux, in that it has been tested on Linux Mint and Manjaro.
https://docs.solokeys.io/udev/
Perhaps their documentation will help you figure out how to get your YubiKey to work?
On Linux, by default USB dongles can't be accessed by users, for security reasons. To allow user access, so-called "udev rules" must be installed.
- i think an opensource option is a good idea however the only reason why i want a yubi key is for the yubikey Bio. which has a fingerprint scanner to make sure its really you. i dont know of any other brand that has a finger print scanner for 2FA. if it wasnt for the scanner i would probably go with a solokey
  
  That's fair, I'm personally against biometrics, because if someone ever gets a copy of your fingerprint... it's not a "password" that can be changed. Fingerprints can be faked.
  https://www.pcmag.com/news/hacking-fingerprints-is-actually-pretty-easy-and-cheap
  Once again, personal opinion. You gotta do what works for you.
  I'm hoping maybe the link I sent might have some info on getting it set up properly on NixOS. Maybe it just needs those udev rules installed first?
  
  i did find FEITIAN BioPass FIDO2 which still is not open sourced but is an alternative for a yubikey, there is no app tho
I've used the Authenticator app on Ubuntu and Arch (and the Steamiffied Arch running on the Steam Deck). I found the best thing is to manually download the tar from their official site, the make symlinks as necessary to get it in your path.
In theory flatpaks are trustworthy, but I wouldn't spend the money and time to get TOTP on my Yubikeys (always have a backup!) - just to hope nobody is injecting something malicious into the flatpak.
An alternative is to not rely on desktop apps, but use the iOS or Android apps - both are signed/authored by Yubico if I recall correctly.
To mirror what another commenter said, also look at using FIDO whenever possible - it's not going to get caught up by a keylogger or a shoulder surfer.
This yubikey app is packaged for Nix, the package is called yubioath-flutter
It probably requires you to set services.pcscd.enable = true;
I have used my Yubikey to do FIDO2 auth on Linux Mint with Chromium and Firefox. I have tried M365, Twitter and Facebook but any website that supports FIDO2 should work.
Did not need to install any OS components.

11 comments