3 ms·

It also has a few downsides: Adding a new key requires re-encrypting every entry. Touching your yubikey hundreds of times gets old, fast.

jehteh 5y ago
If you are using GPG keys and have the master key backed up somewhere you can fairly easily use that on an offline machine to add the new key to the full batch of password files without needing to perform a million button presses.
- doubled112 5y ago
  Been there and done that. People are backing up those keys, right? Could also disable the touch to decrypt feature while you performed the rekey?
  - jehteh 5y ago
    I hope people back up their GPG keys (and test their backups! My subkeys on the yubikey expire annually, forcing me to validate my master key backup at least once a year). Disabling touch is another option if you need to do a large batch of operations and are comfortable that your machine is secure.
  - kenmacd 5y ago
    You probably shouldn't be able to disable touch. If you can disable it then malware can disable it. I'd highly recommend using the `fix` option instead of `on` to make sure it can't be disabled.
- captn3m0 5y ago
  Yup. My backup key (the one that doesn’t travel with me) doesn’t have the touch policy and I use that for any bulk operations.
taeric 5y ago
I'm not sure I follow. Adding a secret is done with your public key, so no need to even touch the yubikey to do that. And the idea is each one is a separate file. So, adding does not impact any other file. Edit: oh. Adding a new key, not password. I see how I misread.
INTPenis 5y ago
Touching? What? I did this recently and it's very simple thanks to pass init. I now have two keys, my old one and my new one that is on my yubikey.
- kenmacd 5y ago
  Did you have our key on a yubikey and that yubikey set to require a touch for every operation?
  - INTPenis 5y ago
    No I wasn't even aware of this feature. I just enter my pin once and it works until I pull it out.
    - kenmacd 5y ago
      Here's a script that will set that mode, in case you'd like to use it. It prevents someone/malware from being able to use your key after you've unlocked it. For example if you hacked my computer and tried to use it to ssh to another machine you'd be unable because you'd need me to tap the key. I'd suggest trying 'on' before 'fix', but then switching to 'fix' for the extra security it provides. https://github.com/a-dma/yubitouch https://github.com/a-dma/yubitouch

jehteh 5y ago

If you are using GPG keys and have the master key backed up somewhere you can fairly easily use that on an offline machine to add the new key to the full batch of password files without needing to perform a million button presses.

doubled112 5y ago
Been there and done that. People are backing up those keys, right? Could also disable the touch to decrypt feature while you performed the rekey?
- jehteh 5y ago
  I hope people back up their GPG keys (and test their backups! My subkeys on the yubikey expire annually, forcing me to validate my master key backup at least once a year). Disabling touch is another option if you need to do a large batch of operations and are comfortable that your machine is secure.
- kenmacd 5y ago
  You probably shouldn't be able to disable touch. If you can disable it then malware can disable it. I'd highly recommend using the `fix` option instead of `on` to make sure it can't be disabled.
captn3m0 5y ago
Yup. My backup key (the one that doesn’t travel with me) doesn’t have the touch policy and I use that for any bulk operations.

taeric 5y ago

I'm not sure I follow. Adding a secret is done with your public key, so no need to even touch the yubikey to do that. And the idea is each one is a separate file. So, adding does not impact any other file. Edit: oh. Adding a new key, not password. I see how I misread.

INTPenis 5y ago

Touching? What? I did this recently and it's very simple thanks to pass init. I now have two keys, my old one and my new one that is on my yubikey.

kenmacd 5y ago
Did you have our key on a yubikey and that yubikey set to require a touch for every operation?
- INTPenis 5y ago
  No I wasn't even aware of this feature. I just enter my pin once and it works until I pull it out.
  - kenmacd 5y ago
    Here's a script that will set that mode, in case you'd like to use it. It prevents someone/malware from being able to use your key after you've unlocked it. For example if you hacked my computer and tried to use it to ssh to another machine you'd be unable because you'd need me to tap the key. I'd suggest trying 'on' before 'fix', but then switching to 'fix' for the extra security it provides. https://github.com/a-dma/yubitouch https://github.com/a-dma/yubitouch