3 ms·
That's why the standard recommendation is to generate keys on an airgapped computer without persistent storage, and run keytocard from there. I have a set of d
by tadfisher 5y ago
That's why the standard recommendation is to generate keys on an airgapped computer without persistent storage, and run keytocard from there.
I have a set of dead Yubikey 4s that are blacklisted from GitHub because the onboard key generation code generated insecure keys (nevermind that I didn't use that feature, but wygd).
- woodruffw 5y agoThe overarching best practice is to reduce the number of points of compromise/failure to a bare minimum: if your trusted hardware can generate its own keys, then you shouldn't establish a separate trust relationship with a different machine to generate keys that get imported into your trusted hardware.