2 questions yubikey / sms

Originalcahummer

First, thank you to the general forum population. So far, my novice questions have been replied to with grace. It's not so safe to be a novice everywhere :)

Question 1) Is it possible to require a yubikey or similar for phone unlock? I've read that fingerprint is OK, swipe is not so great, long pin is probably the best. Just curious if the phone could be unlocked and maybe stay unlocked with a fido key in place?

Question 2) I will never get my small mostly older friends group to switch to a private messaging app. I've tried to suggest it and the common theme is "we're not changing (just for your weird preoccupation with privacy)." With that said, I like the idea of RCS but I hate google so...should I stick with the SMS built into Graphene or is there another option? Also, if one SMS app is just like any other, is there a FOSS app that might be more feature rich?

Thanks

gk7ncklxlts99w1

Originalcahummer

I believe the only way to use yubikey to unlock your phone is using a static password (yubikey basically just acts like a keyboard to paste a password), and enable USB data transfer while locked in your settings (Exploit Protection > "Charging-only when locked, except before first unlock" or "On"). Plug the yubikey in via USB while its locked and tap it.

I remember looking into this issue a long time ago, I have a feeling neither Android nor GrapheneOS are interested in implementing something like U2F or challenge response for unlocking the phone. Something about it being unnecessary maybe.

Can't give you a proper answer for the second question. I use regular SMS with the default app, but I don't really have friends, so.

argante

Originalcahummer Question 1) Is it possible to require a yubikey or similar for phone unlock?

That doesn't make much sense. The Pixel has a built-in Titan M security chip, so you already have a yubikey in your phone.

area51

Originalcahummer
I also use Yubikey for several reasons, but think gaining access to my phone would not be one of them. I feel GrapheneOS has this covered satisfactorily.

I agree that family cannot be swayed from WA etc. I don't use it, family members do. I have Molly, so we are at an impass in that regard. I also like Onion share, but they would need to work at it, however I finf convenience is king over secure, safe, etc.

DeletedUser237

argante you obviously miss the point that yubi would be something you have for 2fa..

argante

DeletedUser237

Question 1) Is it possible to require a yubikey or similar for phone unlock? I've read that fingerprint is OK, swipe is not so great, long pin is probably the best. Just curious if the phone could be unlocked and maybe stay unlocked with a fido key in place?

Where does he say about 2FA?

You can use a password/pin, then yubikey/nitrokey etc. But you can also use just yubikey to unlock your phone (I have Nitrokey). There you can configure the password or key in Nitrokey to be secured with a pin. So when using it you have to enter a pin, but Titan works exactly the same way in GOS. So there is no need to add such a duplicate solution - and this will most likely weaken security because Titan security element is well integrated in GOS. Yubikey would require an additional external application, access via USB or NFC and all the risks associated with it.

Originalcahummer

For what it's worth, my thought was not to add additional security to GOS or phone. I was thinking of using a key instead of passcode or pin code. If my car keys (and yubikey) are dangling from my phone, it's unlocked. If no yubikey, I have to enter a long pass phrase and phone relocks after 30 seconds.
Thanks for the input.

s0ul3ssphantom

I feel like a security key unlock would have the same lack of 4th amendment protections as fingerprint unlock.