4 ms·
I’m going to need to work this out soon. I picked up a pair of new YubiKey 5Cs yesterday with their sale. I’ve been using a YubiKey Neo for years for U2F, TOTP
by bpye 4y ago
I’m going to need to work this out soon. I picked up a pair of new YubiKey 5Cs yesterday with their sale. I’ve been using a YubiKey Neo for years for U2F, TOTP and GPG.
Moving the GPG key is easy - though I might try using the FIDO2 support in SSH instead. However for every TOTP and U2F key I’m going to have to re-enroll the new keys… It feels like there should be a better way.
- bradstewart 4y agoIt would indeed be nice if you could "cross sign", CA style, a new yubikey with an old one, and that would somehow get passed along to the various services. I have not thought about the various attack vectors that this may or may not enable though.
- andrey_utkin 4y agoI've recently started to track my service dependency graph! So like, to keep using github I need my password store, my email and one of my two security keys. To use my email, I need... Please contact me if you're interested, I will release the tooling I have.
- _vdpp 4y agoFIDO2 with resident SSH ed25519 keys works great, just make sure the OpenSSH client and server versions on all the machines you’ll be using the key on support it. I wish there was a way to sign Git commits somehow using them instead of PGP.
- jameswryan 4y agoThere is as of Git 2.34 [0][1]. [0] https://github.blog/2021-11-15-highlights-from-git-2-34/#tidbits https://github.blog/2021-11-15-highlights-from-git-2-34/#tid... [1] https://git-scm.com/docs/git-config#Documentation/git-config.txt-gpgprogram https://git-scm.com/docs/git-config#Documentation/git-config...
- _vdpp 4y agoOh nice! No more futzing around with GPG. You just made my day.
- lrvick 4y agoYou can backup/restore FIDO2 keys via BIP39 on supported devices like a Ledger or Trezor.