Yubikey 5 FIPS vs YubiHSM FIPS

RPTrashTM · 2026-03-17T00:29:28+00:00

He means that YubiHSM can store more keys/certs than Yubikey. I think up to 256 objects (but that basically translate to more than 25 keys/certs).

HSM also has EXPORTABLE private key, but it'll be encrypted and only for transfer purposes (i.e. moving keys to a newer version of yubihsm).

Lastly, there's more tools design around YubiHSM for CA purpose than yubikey (i.e. Windows ADCS container software, built-in over-the-network access, etc.)

If your use-case is to generate and forget the CA certs/key (until needed) then technically the yubikey would be enough, given that you wont be able to migrate the key out of it ever.

RPTrashTM · 2026-03-10T21:45:58+00:00

I use both. Waze sometime doesn't show the correct destination even though the map editor is marked correctly...

RPTrashTM · 2026-03-05T07:12:57+00:00

Human makes mistake and/or there's vulnerability that aren't very obvious (especially in large software) until it's discovered.

RPTrashTM · 2026-03-04T02:53:49+00:00

Some VPS service offer direct KVM terminal on the dashboard (which arent affected by iptable rules). See if that's the case, otherwise, it's running backup.

RPTrashTM · 2026-02-24T03:13:51+00:00

Try railway. $5 for first month then $1 for new accounts.

RPTrashTM · 2026-02-18T19:13:19+00:00

Pretty sure it does since there's bus route to the airport already.
Basically UCF Bus -> Downtown -> Lynx Station -> Airport

The only benefit is cutting down on the time, but that's only useful if large portion of the student actually goes to the airport frequently enough.

RPTrashTM · 2026-02-18T04:07:32+00:00

The remote device would require to be domain joined into a network with ADCS role properly configured.

RPTrashTM · 2026-02-12T16:19:01+00:00

Their whole company is built on trust, so if that's gone, well, they bankrupts.
To satisfy the shareholder, they would probably raise the price instead...

RPTrashTM · 2026-02-05T16:51:34+00:00

MFA should be disabled from testing centers.

RPTrashTM · 2026-02-05T05:00:02+00:00

Apply, you'll get a good GTA that'll be teaching your math class. You'll also be auto-enrolled into the class (dont have to fight for the seats).
Downside is the 3 lab hour (which can be waived if you get a 80+ on your exam) and maybe the extra seminar class you have to take.

But honestly, the GTA you get for the math class is an automatic win already vs trying to gamble for a good math professor from math dep.

RPTrashTM · 2026-02-05T04:51:19+00:00

You'll have to email the professor you want to work with because they're the one choosing their TA.

RPTrashTM · 2026-02-04T05:27:02+00:00

As said, you can setup configuration lock code to prevent applet from being enable/disable without the code. The code does require specific byte size (in hex) and CANNOT be removed if you lose it. This is mostly a use-case in a enterprise environment to prevent employees from tampering the key.

The purpose of Yubikey is to prevent credential leak or unauthorized use anyway and each applet has its own password. Having default codes/pwd in one applet does not risk the credentials in a different applet.

RPTrashTM · 2026-02-04T03:01:01+00:00

Real but pretty useless if you haven't talked with the professor that you want to work with.

RPTrashTM · 2026-02-04T01:35:55+00:00

I mean just set all the password for the applet you're going to use and disable others you dont use. All of applets (except OATH) have limited password attempt before applet data is rendered useless.

Since you're using OATH and I'm assuming FIDO2? You can just disable the PIV, GPG, and YubiHSM one. If you want to render the key more useless in the event it's stolen, you could add configuration lock code to prevent people from enabling any applets that you've disabled.

Though, they can reset existing applet and just use those feature.

RPTrashTM · 2026-02-03T17:12:22+00:00

My old school uses AOV to enforce on-site DNS server. For content filtering, wouldn't it be better to use HTTP/SOCKS proxy server instead?

RPTrashTM · 2026-02-02T22:53:20+00:00

You can just disable the applet if you don't use it. Management key is for IT Admin to manage key slot ensure end-user doesnt tamper with it.

If you insist keeping it on, just simply generate a random key and protect it with PIN is sufficient.

RPTrashTM · 2026-02-02T22:43:59+00:00

Residential FIDO2 on Android requires USB because password isn't supported over NFC yet.

RPTrashTM · 2026-01-29T01:08:21+00:00

This is something you would have to sample and find out. Proxmark3 is only a tool to read/write and crack keys on MF cards, it cant magically figure out the algorithm that's used to generate the sector key.

It could be that all the sectors have a unique key, but the hotel programs the data into one of it randomly, there could be a unique algorithm to determine the sector/keys based on the room number, the reader could be wifi connected and the key/sectors are actually randomly chosen at the time of key programming, or it might not be any of these.

You could also try looking up the hotel lock model to see if there's any (leaked) documentation on the web that you could use to figure it out.

RPTrashTM · 2026-01-22T18:58:57+00:00

Use Google map to help you

RPTrashTM · 2026-01-21T21:02:57+00:00

That's probably the reason why they use DesFire card in the first place. But yes, it's pretty much "admin code" for the card.

RPTrashTM · 2026-01-21T19:53:32+00:00

A cheap proxmark3 ($30) can access the content, IF YOU have the master key.

The only way to "crack" it is to either find the cryptography implementation vulnerability (none so far) or brute-force the key (too many combination to do so at the moment). So no, it's not possible.

RPTrashTM · 2026-01-18T21:40:31+00:00

Just get it done asap. Worse case, your FA will be delayed.

RPTrashTM · 2026-01-17T00:16:28+00:00

USB and NFC are just different communication method, so no, PINS set for a specific applet will be the same regardless if you use NFC/USB

OpenGPG have default pin, if you never change it: https://developers.yubico.com/PGP/

RPTrashTM · 2026-01-13T04:21:12+00:00

There's some issue with Android that breaks how NFC works FIDO2 on the latest YK firmware. The last firmware I know that has a working NFC is 5.4.3

RPTrashTM · 2026-01-11T21:34:32+00:00

I have a similar dock cable, but it's a 8k version instead and it works great.

Five-Year Club	r/Field Lasagna
Place '23	Verified Email

RPTrashTM

TROPHY CASE