4 ms·
I set it to `on`. I read somewhere on internet an argument why `fixed` is not really necessary: for setting it back to `off` you need the admin PIN, and you hav
by StreakyCobra 8y ago
I set it to `on`. I read somewhere on internet an argument why `fixed` is not really necessary: for setting it back to `off` you need the admin PIN, and you have only 3 tries (by default) for the password. So I am not really worried about someone managing to disable it. And that keep the possibility to change my mind later on open, without having to reset the key.
- naggie 8y agoI have it on -- if my Yubikey is locked out or lost, it's not a problem as I have a backup of the master key in my safe. I could revoke the subkeys if the yubikey is stolen, or trust that whoever finds the yubikey has only three attempts on the pin. Also I further mitigate the risk by having an explicit wrapper (gssh) to be selective about when I forward GPG/SSH agent.