4 ms·

Trezor - I've been using one for years and it's great. Also you can backup/restore the seed (so you don't need to register multiple devices).

by rendaw 5y ago

xur17 5y ago
I just ran across this comment, and realized it also works with gpg. I really wish yubikeys supported this backup mechanism as well (given their size), but I'm very tempted to make the jump.
- beagle3 5y ago
  I haven’t used yubikeys in a while, and they never supported backups, but they did support key import for GPG when I used them — so you can make a key some other way, and then put it on as many yuvikeys as you care to. Isn’t that enough for your use case?
  - xur17 5y ago
    That's actually the process I use right now. The problem is that it relies upon an old laptop and several usb keys for backup. It's much easier to backup 24 words on a sheet of paper than a full gpg key. Plus, those 24 words can also recover your u2f keys, crypto wallets, etc. The 24 word backup is something crypto has gotten right that I wish private key setups would replicate.
noch 5y ago
> Trezor - I've been using one for years and it's great. Also you can backup/restore the seed (so you don't need to register multiple devices). Trezor does not make use of a secure element https://blog.trezor.io/is-banking-grade-security-good-enough-for-your-bitcoins-284065561e9b#.vc68zeeqp https://blog.trezor.io/is-banking-grade-security-good-enough...
gorgoiler 5y ago
I don't know the details but it doesn't sound great if you can exfiltrate secret material – the seed? – from a device. A good smartcard should generate its own keys, on device, and only divulge them when persuaded to do so by an electron microscope.
- rendaw 5y ago
  You can't exfiltrate it - you can generate a seed externally and load it in, and back it up if you choose.
  - gorgoiler 5y ago
    You can extract the seed, clone it into a new device, and get the exact same device with the same private key material?
    - ThePowerOfFuet 5y ago
      Yes, but you can extract it only once; the device will refuse to provide it if it's already been provided.

Trezor - I've been using one for years and it's great. Also you can backup/restore the seed (so you don't need to register multiple devices).

by rendaw 5y ago

Trezor - I've been using one for years and it's great. Also you can backup/restore the seed (so you don't need to register multiple devices).

xur17 5y ago

I just ran across this comment, and realized it also works with gpg. I really wish yubikeys supported this backup mechanism as well (given their size), but I'm very tempted to make the jump.

beagle3 5y ago
I haven’t used yubikeys in a while, and they never supported backups, but they did support key import for GPG when I used them — so you can make a key some other way, and then put it on as many yuvikeys as you care to. Isn’t that enough for your use case?
- xur17 5y ago
  That's actually the process I use right now. The problem is that it relies upon an old laptop and several usb keys for backup. It's much easier to backup 24 words on a sheet of paper than a full gpg key. Plus, those 24 words can also recover your u2f keys, crypto wallets, etc. The 24 word backup is something crypto has gotten right that I wish private key setups would replicate.

noch 5y ago

> Trezor - I've been using one for years and it's great. Also you can backup/restore the seed (so you don't need to register multiple devices). Trezor does not make use of a secure element https://blog.trezor.io/is-banking-grade-security-good-enough-for-your-bitcoins-284065561e9b#.vc68zeeqp https://blog.trezor.io/is-banking-grade-security-good-enough...

gorgoiler 5y ago

I don't know the details but it doesn't sound great if you can exfiltrate secret material – the seed? – from a device. A good smartcard should generate its own keys, on device, and only divulge them when persuaded to do so by an electron microscope.

rendaw 5y ago
You can't exfiltrate it - you can generate a seed externally and load it in, and back it up if you choose.
- gorgoiler 5y ago
  You can extract the seed, clone it into a new device, and get the exact same device with the same private key material?
  - ThePowerOfFuet 5y ago
    Yes, but you can extract it only once; the device will refuse to provide it if it's already been provided.