As hardware security tokens are unique and designed to be extremely hard to copy you can’t just make a backup of it as with software vaults like Keepass or AndOTP. Always setup a backup keyĪs soon as you start working with security tokens you have to account for the potential to lock yourself out of accounts tied to these tokens. Added security on the other hand covers multi-factor authentication (MFA) scenarios as well as storing private credentials.

Convenience covers anything from using the hardware token to unlock your LUKS encrypted disk to logging in to your Fedora Workstation with the press of a button. Use-cases are roughly divided into two categories: convenience and added security.

Nowadays hardware security tokens are quite versatile and can be used for a variety of interesting things. These tokens require extreme dedication, time and money to forge or maliciously acquire. Such a token and its secrets can not be copied by large malware attacks.Īpplications and services that have to authenticate your access can use a physical token as a factor of ownership and identification. Hardware security tokens are a physical, cryptographically secured storage for secrets.

In times of sophisticated malware and always-and-everything-on(line), software based storage of credentials becomes at least unsettling. This article explains how to configure Yubico’s YubiKey, a hardware security token, and Fedora Linux Workstation for typical use-cases such as logging into GDM, authentication for the sudo command, OpenSSH authentication and key management, or as a second-factor on the web.

Yubico authenticator