4 ms·
Yes, I think it would be great to be able to create the key otuside of the physical hardware token, just like you can do with the GPG applet on the Yubkey. Stor
by vladvasiliu 4y ago
Yes, I think it would be great to be able to create the key otuside of the physical hardware token, just like you can do with the GPG applet on the Yubkey. Store the original on some offline, encrypted media, ideally in multiple places.
This way, you don't need to have two yubikeys on hand and register them both on every new site. But in case you lose, it's not impossible to create a new one. Yet, obtaining the key from the hardware token shouldn't be any more possible than with the current system.
- Godel_unicode 4y agoThese two goals are mutually exclusive. If you let people generate their own key material outside the enclave, people will be emailing it to themselves just in case.
- ilyt 4y agoWell, non-stupid people also use yubikeys, so they are not mutually exclusive
- Godel_unicode 4y agoMaybe, but there are also a lot of people who don’t understand the point of yubikeys that want to use them but export the secrets. Those people cannot be trusted with their own security and need to be protected from themselves.
- ilyt 4y agoNope, let them be burned, the sooner the better, before they own something actually valuable behind the account
- Godel_unicode 4y agoWhat a truly psychopathic take, I really hope you’re not making decisions that effect people.
- diggernet 4y agoI have the same opinion of people who want to control others because they "need to be protected from themselves".
- Godel_unicode 4y agoSo I take it you’re against food safety standards, seatbelt laws, taxes on cigarettes, the clean air act, payday loan reforms, etc. Most people will never understand this subject, and the fact that they don’t need to is a good thing. If you want a hobby, great, you can go figure out how to do that. The default needs to be safety.
- neatze 4y agoNo one mentioned exporting keys, but importing to yubikey (one way) same as it is already done with gpg on air gaped machine versus generating fido private key on reset within yubkey itself.
- Godel_unicode 4y ago1) yes they did, I suggest you look again. 2) That’s the same thing. The end state is wanting the key material outside of the secure element, which is foolish.