3 ms·
I use it with PKCS#11 mode and can't confirm some of the drawbacks the author mentions under Alternatives: > The UX of this solution is poor: [...] and needs m
by m3nu 6y ago
I use it with PKCS#11 mode and can't confirm some of the drawbacks the author mentions under Alternatives:
> The UX of this solution is poor: [...] and needs manual reloading every time the YubiKey is unplugged or the machine goes to sleep.
I never have to re-enter the PIN after sleep and can even unplug it for a while to use the port for HDMI output.
Still good to see some work in this space. Native OpenSSH support would be best of course.
- Boulth 6y agoYeah I had the same experience using OpenPGP applet on the Yubikey both on Linux and Windows. It just works. Maybe it was a problem once but got improved with time?
- DCKing 6y agoI can confirm the author's experience with Apple's SSH-agent implementation. It does not allow you to load Yubikey agent libraries from Homebrew's default /usr/local, which makes it an inconvenience to set up.
- FiloSottile 6y agoIt surely depends on the OS, and on the PKCS#11 implementation. I tested ykcs11 and OpenSC on macOS and they were like I described. I had started this project as a simple setup tool for PKCS#11 configurations and had to build the agent to get the UX I wanted. Also, not having to re-enter the PIN after unplug means it's being cached in memory rather than on device, which I'm not a fan of. In yubikey-agent that's handled by using a graphical pinentry during operation to avoid the manual unlock step.