Post by @hipsterelectron@circumstances.run

@hipsterelectron@circumstances.run 5 mo. ago

one of the yubico developers who signed version 5.9.0 of their linux tarball two months ago is using an expired RSA key https://developers.yubico.com/yubikey-manager/Releases/

gpg: assuming signed data in '../yubikey_manager-5.9.0.tar.gz'
gpg: Signature made Thu 22 Jan 2026 09:38:27 AM EST
gpg: using RSA key 20EE325B86A81BCBD3E56798F04367096FBA95E8
gpg: Good signature from "Dain Nilsson <dain@yubico.com>" [expired]
gpg: Note: This key has expired!
Primary key fingerprint: 20EE 325B 86A8 1BCB D3E5 6798 F043 6709 6FBA 95E8

this guy walks around with a 2048-bit rsa key for a whole decade

pub rsa2048 2014-01-10 [SC] [expired: 2025-04-29]
 20EE325B86A81BCBD3E56798F04367096FBA95E8
uid [ expired] Dain Nilsson <dain@yubico.com>

this isn't a standard yubico practice. look at nigel right above him

pub rsa4096 2019-05-13 [SC] [revoked: 2020-04-15]
 1DC4BA2872525B3F2FE8207F5D9C760A3FB51707
uid [ revoked] Nigel Williams <nigel.williams@yubico.com>

4096 and actively revoked after one year. i'm gonna find another email address to harass now

Releases

8 Replies

3 Boosts

d@nny disc@

@hipsterelectron@circumstances.run 5 mo. ago

prime numbers are awesome but the inventors of RSA are an arm of the NSA and i wouldn't be surprised if were eventually found to be slightly weaker than elliptic curves

d@nny disc@

@hipsterelectron@circumstances.run 5 mo. ago

oh hey guess what else is new about the 5.9.0 release (separate from the war on iran)? there's now a mysterious python wheel? https://developers.yubico.com/yubikey-manager/Releases/yubikey_manager-5.9.0-py3-none-any.whl

which is actually a broken link if you dare to try and click it

d@nny disc@

@hipsterelectron@circumstances.run 5 mo. ago

the adjacent signature does still exist though

d@nny disc@

@hipsterelectron@circumstances.run 5 mo. ago

and it is available on pypi! https://pypi.org/project/yubikey-manager/#files

and again cinderella's shoe fits!

gpg: assuming signed data in '../yubikey_manager-5.9.0-py3-none-any.whl'
gpg: Signature made Thu 22 Jan 2026 09:38:23 AM EST
gpg: using RSA key 20EE325B86A81BCBD3E56798F04367096FBA95E8
gpg: Good signature from "Dain Nilsson <dain@yubico.com>" [expired]
gpg: Note: This key has expired!
Primary key fingerprint: 20EE 325B 86A8 1BCB D3E5 6798 F043 6709 6FBA 95E8

Client Challenge

~20 more replies

d@nny disc@

@hipsterelectron@circumstances.run 5 mo. ago

Author: Dain Nilsson

very good

d@nny disc@

@hipsterelectron@circumstances.run 5 mo. ago

https://github.com/Yubico/yubikey-manager/commit/9fe76be2cbf5e9a3b5a9a8d78411949a028b3745 github seems to think an expired key is "verified" since he's still using the same one here

d@nny disc@

@hipsterelectron@circumstances.run 5 mo. ago

it's so fucking annoying how the astral engineer who made up lies about zip files is also very directly to blame for this exact sequence of events

d@nny disc@

@hipsterelectron@circumstances.run 5 mo. ago

he's not doing anything clearly evil but he very directly switched the repo over to the astral cinematic universe exactly 2-3 months ago which was precisely when his 2048-bit RSA key died