3 ms·

I use my yubikey as GPG key for mail and for pass(). I really like having a backup.

by Xylakant 9y ago

jnbiche 9y ago
What email program do you use with Yubikey? I'm wanting to integrate more GPG into my email.
- jlgaddis 9y ago
  mutt works wonderfully w/ GPG.
- Xylakant 9y ago
  Thunderbird does the job. Used apple Mail with GPG for Mac before switching to Linux. That had a few glitches but was workable. Anything that can work with GPG and GPGAgent should work with a Yubikey
- darkr 9y ago
  Mail.app and GPGTools gives a pretty good experience if you’re on macOS
helper 9y ago
You can use your yubikey to store your subkeys (still generated on the yubikey itself) while your master key is stored somewhere else. If you lose your yubikey you can revoke the subkeys and generate new ones signed by your existing master key.
- jopsen 9y ago
  With few exceptions: A) you won't be able to decrypt old messages B) you'll have to upload new public SSH keys to all servers If you use 'pass' for storing passwords, then (A) will make your password store unavailable. And (B) is a lot of places you have to update. In fact I aim to make it impossible to connect and update my servers key without having the existing key. -- In short, since sub-key infrastructure really works for signatures, it seems easiest to just backup your subkeys.
  - beagle3 9y ago
    > B) you'll have to upload new public SSH keys to all servers openssh supports a CA model, so .. you can set it up so that the servers trust the CA and the CA blesses the new key. Obviously, it just shifts the "but what if we lose the .." question from the user key to the CA key, but in many cases it makes a difference.
    - Xylakant 9y ago
      You could also have some sort of mechanism that updates the various servers (puppet, ...) or central authentication via LDAP. SSH logins are the least of my worries. Not being able to access my passwords would suck, though :)
  - rkeene2 9y ago
    My password manager, hunter2 (https://chiselapp.com/user/rkeene/repository/hunter2/ https://chiselapp.com/user/rkeene/repository/hunter2/ ), overcomes this by spring multiple keys per password. If you change the password then all keys that currently know the password will also be updates.
    - Xylakant 9y ago
      pass() can make passwords readable by multiple keys as well, but then I'd have to add the keys before loosing one. Possible, but, well, a usb stick in a safe location does the job for me currently.

I use my yubikey as GPG key for mail and for pass(). I really like having a backup.

jnbiche 9y ago

What email program do you use with Yubikey? I'm wanting to integrate more GPG into my email.

jlgaddis 9y ago
mutt works wonderfully w/ GPG.
Xylakant 9y ago
Thunderbird does the job. Used apple Mail with GPG for Mac before switching to Linux. That had a few glitches but was workable. Anything that can work with GPG and GPGAgent should work with a Yubikey
darkr 9y ago
Mail.app and GPGTools gives a pretty good experience if you’re on macOS

helper 9y ago

You can use your yubikey to store your subkeys (still generated on the yubikey itself) while your master key is stored somewhere else. If you lose your yubikey you can revoke the subkeys and generate new ones signed by your existing master key.

jopsen 9y ago
With few exceptions: A) you won't be able to decrypt old messages B) you'll have to upload new public SSH keys to all servers If you use 'pass' for storing passwords, then (A) will make your password store unavailable. And (B) is a lot of places you have to update. In fact I aim to make it impossible to connect and update my servers key without having the existing key. -- In short, since sub-key infrastructure really works for signatures, it seems easiest to just backup your subkeys.
- beagle3 9y ago
  > B) you'll have to upload new public SSH keys to all servers openssh supports a CA model, so .. you can set it up so that the servers trust the CA and the CA blesses the new key. Obviously, it just shifts the "but what if we lose the .." question from the user key to the CA key, but in many cases it makes a difference.
  - Xylakant 9y ago
    You could also have some sort of mechanism that updates the various servers (puppet, ...) or central authentication via LDAP. SSH logins are the least of my worries. Not being able to access my passwords would suck, though :)
- rkeene2 9y ago
  My password manager, hunter2 (https://chiselapp.com/user/rkeene/repository/hunter2/ https://chiselapp.com/user/rkeene/repository/hunter2/ ), overcomes this by spring multiple keys per password. If you change the password then all keys that currently know the password will also be updates.
  - Xylakant 9y ago
    pass() can make passwords readable by multiple keys as well, but then I'd have to add the keys before loosing one. Possible, but, well, a usb stick in a safe location does the job for me currently.