I got an onlykey a few months ago and unfortunately had issues trying to get it to work with Qubes (using the onlykey qubes doc) then had some things come up so just got around to figuring this out again.
First, just to make sure (hardware tokens are new to me), I should be able to update firmware and setup my onlykey say on win8 then use it day to day on my qubes box correct?
Other questions are:
How difficult would it be to set things up so that onlykey can be used to unlock an encrypted/LVM drive?
Once I have onlykey setup, I should just be able to plug it in, connect, via qubes devices, my onlykey to the appvm (that say has gmail open) and then be able to unlock my account?
Lastly, can I have onlykey setup to work with my lockscreen?
OnlyKey types passwords just like a USB keyboard, so if you can use a keyboard to do all of those things you can use OnlyKey. For example, assign your LUKS passphrase to a slot on OnlyKey then press that button to have the password typed out to unlock drive.
Thank you @t11, I guess i was thinking more in the way of a second factor, so I could put in the password (or setup OnlyKey to do it) and then use onlykey token as well? Again, all this is new to me so pardon if i am using the incorrect terminology. While I will totally be using the password feature I was hoping to add a second level/layer of authentication wherever possible (email accounts, desktop lockscreen, drive decryption, password manager etc).
Generally 2FA for full disk encryption isn’t supported without some sort of 3rd party service. For other things you would just use whatever standard the application supports TOTP, Yubikey OTP, FIDO U2F.