16 ms·

So if your mac dies, you effectively lock yourself out of any servers ? Or do you have a backup key ? If so, how do you protect that ? Not criticizing, just ge

• GekkePrutser 6y ago
  You can always add more authorized keys.. That's what I do and definitely the way to go for this scenario.
  • archi42 6y ago
    With ssh the situation is quite good, and it should serve as an example on "how to do it right". I find web services to be a huge pain, though: Obviously most don't offer any kind of 2FA, or maybe Google Authenticator or SMS at best (which means those websites must be so bad that people don't login to it on their phone?). But even those who do "proper" 2FA often will only allow a single U2F token - and enforce GA, SMS or a secondary email as fallback. (Putting this rant here so maybe a webdev or even two do it better the next time they do some auth stuff ;-))
• lucideer 6y ago
  > do you have a backup key ? You should always have keys per device (as has been discussed in other comments here). So if you have >1 device, you'll automatically have backups. > If so, how do you protect that ? While it may seem bad to have some keys less securely protected than others, the ability to revoke a single device means that using Yubikey / Secure Enclave / whatever on one device is still better than using them on none.