3 ms·

Hah, I saw this just after sending a newsletter issue on my password management solution, which is based on passage [1] (a fork of password-store [2] that uses

Hah, I saw this just after sending a newsletter issue on my password management solution, which is based on passage [1] (a fork of password-store [2] that uses age [3]) and YubiKeys. My age+YubiKeys Password Management Solution — https://words.filippo.io/dispatches/passage/ https://words.filippo.io/dispatches/passage/ The main feature is some protection against post-compromise exfiltration: even if an attacker fully compromises my laptop, they can't extract the whole vault. [1]: https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage [2]: https://www.passwordstore.org https://www.passwordstore.org [3]: https://age-encryption.org https://age-encryption.org

zikduruqe 4y ago
I updated to 1.1.1 yesterday and hope to try with a Yubikey here soon.
imiric 4y ago
Very cool! Thanks for all your work! I was waiting for a solution to store age keys on a security key, and it's great that it's now possible with YubiKeys. I currently use smart cards to store my GPG keys, which works even on Android, as there are some that support NFC, so I can use them with the OpenKeychain and Password Store apps. I need to have passwords available on mobile, as often when I'm traveling I don't want to lug around a laptop. The QR code solution you suggest doesn't seem optimal. Would it be possible to achieve the same workflow with age and NFC YubiKeys? I suppose it would need a native mobile app for that to work.
- FiloSottile 4y ago
  If using the OpenPGP applet over NFC is possible, then it's almost certainly possible to use the PIV one with age keys too! The Andorid password-store app is working on an implementation of age in Kotlin (https://github.com/android-password-store/kage https://github.com/android-password-store/kage) and I think they already support passage stores. Maybe you could open a feature request for age-plugin-yubikey compatibility? If you do, feel free to tag me, and I can help make sure the formats are well specified.

zikduruqe 4y ago

I updated to 1.1.1 yesterday and hope to try with a Yubikey here soon.

imiric 4y ago

Very cool! Thanks for all your work! I was waiting for a solution to store age keys on a security key, and it's great that it's now possible with YubiKeys. I currently use smart cards to store my GPG keys, which works even on Android, as there are some that support NFC, so I can use them with the OpenKeychain and Password Store apps. I need to have passwords available on mobile, as often when I'm traveling I don't want to lug around a laptop. The QR code solution you suggest doesn't seem optimal. Would it be possible to achieve the same workflow with age and NFC YubiKeys? I suppose it would need a native mobile app for that to work.

FiloSottile 4y ago
If using the OpenPGP applet over NFC is possible, then it's almost certainly possible to use the PIV one with age keys too! The Andorid password-store app is working on an implementation of age in Kotlin (https://github.com/android-password-store/kage https://github.com/android-password-store/kage) and I think they already support passage stores. Maybe you could open a feature request for age-plugin-yubikey compatibility? If you do, feel free to tag me, and I can help make sure the formats are well specified.