3 ms·
Signing with a separate hardware-stored SSH key on a dongle (e.g.: Yubikey/FIDO2) will allow you to have a long-lived key without the risk of compromise.
by smileybarry 4y ago
Signing with a separate hardware-stored SSH key on a dongle (e.g.: Yubikey/FIDO2) will allow you to have a long-lived key without the risk of compromise.
- 8organicbits 4y agoIf you're using a dongle, I expect you'd have your other SSH keys there as well. Is there a security benefit to using a separate SSH key if they all live on the same dongle? I'm having trouble thinking through that. Although, certainly the hardware dongle has security benefits over SSH keys on disk.
- smileybarry 4y agoYes -- you can separate identities if you want, and rotating keys means changing a lot less places, so you can compartmentalize your processes.