> >* Theft or loss of the laptop does not mean loss of token. > Doesn't seem relevant when you probably have FDE enabled. You still need to regard the key as c

> >* Theft or loss of the laptop does not mean loss of token. > Doesn't seem relevant when you probably have FDE enabled. You still need to regard the key as compromised - it's no longer under your control and you have no idea what a potential attacker would try. Most FDE does not lock the disk when the computer goes to sleep, so the attacker can now try to break in via Firewire, ... While with a physical token, as long as the token is in your possession, the key is entirely under your control (unless you have a backup on your computer, which kind of goes against the idea) > Therefore, it's safe to assume that attackers interested in your key files are also sophisticated enough to perform the pivot. Like they strictly did not even attempt in that case? This seems to be targeting python developers. Now, with a python developers ssh keyfile and gpg keyfile (if I manage to unlock it), I could do quite a bit of damage For example try it on github. It's trivial to associate an ssh key with a github acct - the info is public.