4 ms·
For me, physical smartcard storage + overarching identification. I've been using a Yubikey as my GPG key for a long time (and another in my safe as my GPG root)
by eropple 4y ago
For me, physical smartcard storage + overarching identification. I've been using a Yubikey as my GPG key for a long time (and another in my safe as my GPG root). You can use SSH with FIDO2 today as well, but outside of SSH GPG provides a web of trust which has other benefits, such as a root of revocation (a different Yubikey in my document safe contains my GPG root) and signature validation not being tied to SSH key presence/absence on GitHub.
- aaronmdjones 4y agoI too have a primary YubiKey with my 3 PGP subkeys on it (signing, authenticating, decrypting), and a backup YubiKey in my safe with my PGP master key on it. I find it works quite well. The primary YubiKey goes everywhere I go; I have a lanyard for it. The backup YubiKey stays in the safe until I need it for something (e.g. signing someone else's PGP key, rotating subkeys, renewing the expiration date on a subkey, ...). I also use both of them for FIDO, on websites that support real 2FA; more specifically, I enroll both of them, but I only routinely use the primary one.