On 17/10/11 22:11, seth vidal wrote: > The biggest problems with the yubikeys is: > 1. getting them into people's hands > 2. getting another one into their hands when they lose or break the > last one. > 3. the company who makes them being relatively small and afaict the > only company who makes them. > 4. kinda fiddly. I find those reasons a bit odd. In response: 1. Just mail them to people or let them buy one and configure them themselves. We send swag to people, so there should be finance for the most integral part, to what fedora does, that is build packages and build the OS. So, for the sake of postage, which probably just is a stamp, as the yubikeys are so light, this should not be a problem. 2. Same as above,besides the fact, that they are virtually indestructible! 3. Yes, they are the only company, but they adhere to open standards, apart from the Symantec VIP option, but even that Yubikey, can just be reprogrammed. Also see: http://yubico.com/oath-yubikey 4. What is so fiddly about pressing a "button"? Further, any security system that is contained within an operating system, as with ios, android, etc.. has to be deemed suspicious, a device could be hijacked. Also, even with the YubiKey, there should still be a password the user has/knows. That is the only way to ensure the person is who they claim to be, and not just in the possession of a token. Another option is OpenGPG cards, but then our users would have to have or purchase a card writer/reader, and have it available. Any system has a USB port + the yubikey fits on a key chain. I personally keep a few of them on there, and they haven't even got a scratch yet. In terms of OpenGPG cards, that also could still mean that people keep their keys flying about on their system, and potentially, if FI sent them cards, they could lock themselves out, by using the wrong pin 3 times, requiring the admin pin to unlock the card again. Another thing I like about yubikeys is, that you can run your own api for the key validator, and the backend storing the keys. Surely, due to the nature of what we do, this should not be left to a third party! Especially, if they host this themselves and then nobody can get back into the systems. I could not from a glance see, how google makes this work. Just some thoughts. Regards, Tristan -- Tristan Santore BSc MBCS TS4523-RIPE Network and Infrastructure Operations InterNexusConnect Mobile +44-78-55069812 Tristan.Santore@xxxxxxxxxxxxxxxxxxxxx 1 Former Thawte Notary (Please note: Thawte has closed its WoT programme down, and I am therefore no longer able to accredit trust) For Fedora related issues, please email me at: TSantore@xxxxxxxxxxxxxxxxx _______________________________________________ infrastructure mailing list infrastructure@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/infrastructure
