3 ms·
Various strategies that trade off security vs. convenience. Most secure is probably something simple like printing it out and putting that in a fire-proof safe.
by eikenberry 4y ago
Various strategies that trade off security vs. convenience. Most secure is probably something simple like printing it out and putting that in a fire-proof safe. But there are lots of options. For the non-tech parents or some such, a nice pass-phrase would probably work well as the secret.
- magicalhippo 4y agoHow do you get this pass-phrase from paper onto the yubikey without an adversary getting hold of it? I'm not trying to be pedantic here, I'm just failing to see how this can be realistically implemented without significantly lowing the overall security. But this is also not my domain, so I'd like to learn.
- bradstewart 4y agoImporting keys into an HSM/key storage device is not an uncommon exercise. If you're asking about the structure of the bits you'd need to move into the device in a verifiable way, there are standard APIs like PKCS #11 for interacting with HSMs. You would then need a computer and a PKCS #11 client application. If you don't have a computer you can trust to pass keyboard inputs to a USB port without being intercepted, you've got problems that a yubikey will not solve.
- magicalhippo 4y ago> there are standard APIs like PKCS #11 for interacting with HSMs Thanks, that was the piece I was missing.