> iPhones can be lost too. emphasis on yet another. One more thing to keep track of. Not everyone likes to have their (door) keys hanging off their notebooks a

> iPhones can be lost too. emphasis on yet another. One more thing to keep track of. Not everyone likes to have their (door) keys hanging off their notebooks all day. > Yubikey can do U2F and OTP out of the package with no setup required. Yes, but we're talking about git/ssh here. > While it can be easier (I wrote a nice shell script for myself), I don't consider setting up a Yubikey for SSH hard for the type of person who uses SSH, That's not my experience, but it suppose it might depend on who you know/work with, or in what area you work. > So is the Yubikey software. I was talking about the free beer kind of free, but it's not accurate to say YubiKey is all free (libre) either, it depends on the product. There was quite a controversy a while back[1]. Personally, I'm fine with closed-source security products. Ideological reasons aside, I don't think making decisions based on whether the code is open source makes sense. > I would consider that a fatal flaw. Once the private key is on the device, it should not be easy to recover it from the device. I wouldn't say it's a fatal flaw. You rely on your phone's security to manage access to signing operations anyway, so if an attacker has access to the app, you're pretty much screwed either way. Again, there are trade-offs, but it's a step-up from keeping keys on-device. [1]: https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...