33 ms·
Hmm, gpg-agent has worked nicely for me. The biggest pain is that I have to reconfigure when I switch yubikey. (Yes, I have multiple keys with the same gpg ke
by jopsen 6y ago
Hmm, gpg-agent has worked nicely for me.
The biggest pain is that I have to reconfigure when I switch yubikey.
(Yes, I have multiple keys with the same gpg key on each)
- noodlesUK 6y agoDoesn’t having the same key on multiple devices kinda ruin some of the point of the yubikey? What if you wanted to revoke one after you lost it? Also, how do you store your gpg key? I have a couple yubikeys, but I have different keys on each of them, and I find that works just fine.
- Boulth 6y agoIt's not a big problem because tokens lock themselves after 3 tries so even if someone got your token they'd have to guess it. Having separate subkeys for each token is nice but works best only with the signature subkey. For encryption it doesn't work as GnuPG encrypts only to one subkey. The same with authentication subkey: it doesn't matter if you revoke it because SSH doesn't understand OpenPGP revocations.
- jopsen 6y agoKeep it simple.. once the key is on an yubikey it's not going anywhere.. The biggest risk is that I loose the key.
- Boulth 6y ago> The biggest pain is that I have to reconfigure when I switch yubikey. This is planned to be fixed in GnuPG 2.3.
- jopsen 6y agoWow, how? Currently I understand that gpg records a card identifier. And my card doesn't have the same id. I suppose it'll be a long time before this hits stable distros anyways. But nice to see improvements :)
- Boulth 6y agoIt was some time when I read the explanation on how do they want to approach this but I guess the card identifier will no longer be needed (or all card ids will be stored). If you want to check it yourself https://dev.gnupg.org/T4695 https://dev.gnupg.org/T4695