4 ms·

> To anyone that wants this functionality best-effort safely today: Get a Yubikey 5 or Nitrokey 3, put an ECC PGP keychain on it, enable touch requirements for

> To anyone that wants this functionality best-effort safely today: Get a Yubikey 5 or Nitrokey 3, put an ECC PGP keychain on it, enable touch requirements for all slots, export your keys on keyoxide, then set it up with git, ssh, pass, your email client of choice, etc. But SSH now supports U2F for any FIDO or FIDO2 security key AFAICT (no need to specifically a Yubikey 5 or Nitrokey 3): it's unrelated to GPG. Isn't it better to directly use this new SSH functionality inside of using the more complicated GnuPG+SSH thing? (I'm asking: I've got no clue how the later works). Any thoughts/explanation on this is most welcome. > (Unless you mount /proc with hidepid=2 but this is never a default and almost no one does it) Ah! I do it on all my systems! (not that it'd be a reason to have passwords in plaintext everywhere)

lrvick 4y ago
> Isn't it better to directly use this new SSH functionality inside of using the more complicated GnuPG+SSH thing? (I'm asking: I've got no clue how the later works). If the only thing you need from a smartcard is ssh, and you do not need to convince others your public key is really yours, then FIDO2 ssh is great. That said, if someone is to add my key to their server, exporting my ssh key from my published, and well signed PGP keychain is the easiest way to form trust they got the correct key. Also you cannot do things like file decryption or signed commits with a fido2 device. Since virtually every developer (imo) needs those coming from a hardware anchor, and they require PGP, might as well use one spec that does everything and publishes one public keychain for others to trust.