Yubikey attached to an AppVM - possible?

[JPL]

Because of my setup I can't install a sys-usb qube. Is it possible to attach a Yubikey 4 or Neo to an AppVM such as Personal?

The USB widget does not recognize a Yubikey plugged into a USB slot after booting Qubes OS, although it is seen by Dom0 using the lsusb command, so presumably it's being blocked for being an 'abnormal' USB device.

I notice various people having problems getting Yubikeys to work, but a quick search didn't bring up this particular issue. Is a sys-usb necessary or has anyone found a workaround?

Thanks

[pixel fairy]

does it show up as a keyboard? the default is to ignore keyboards plugged in. you can change that in /etc/qubes-rpc/policy/qubes.InputKeyboard

https://www.qubes-os.org/doc/usb/ (near the end)

[pixel fairy]

https://www.qubes-os.org/doc/yubi-key/

[JPL]

It shows up as:

Bus 003 Device 009 ID:[some-string] Yubico.com Yubikey 4 OTP+UTF+CCID

qvm-usb gives no clues:
BACKEND:DEVID DESCRIPTION USED BY

Edited the file /etc/qubes-rpc/policy/qubes.InputKeyboard as suggested but it doesn't seem to make any difference. Do I need to reboot or something?

I already use a USB keyboard.

Thanks for your help btw.

[JPL]

I should also mention I have Qubes installed on a USB stick, which may be the root cause of the problem

[JPL]

... and in addition when I changed the qubes.InputKeyboard the USB widget stopped working so I have reverted to the original for now.

[j.gr...@gmail.com]

Did you figure out how to do it in the end?

[Jon deps]

On 4/27/19 8:44 PM, j.granyt-Re5JQE...@public.gmane.org wrote:
> Did you figure out how to do it in the end?
>

I ended up finally re-discovering a new trick for OTP eg LP webpage 2FA
using debian-9 minimal as the template

https://www.qubes-os.org/doc/multifactor-authentication/

pretty slick, now I can leave my android off, and not use SMS for 2FA


for U2F logins : there is also a write up in the docs, but its way over
my head prolly circles back to Qubes doesn't want HID-keyboard
emulation to have access via USB

for the few sites for U2F I use, I just use Chromium , if you Yubikey
has both IIRC you have disable one or other of the functions anyway

[FenderBender]

Was thinking of picking one up, but upon research I had thought that the trend is that Yubikeys are not any longer recommended. https://en.wikipedia.org/wiki/YubiKey#YubiKey_4_security_concerns

Perhaps they are still better than other options so I will follow this thread and reconsider my purchase but here are some other avenues to achieve 2FA: https://alternativeto.net/software/yubikey/