3 ms·
There's a fairly excellent guide on creating a robust key system here: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide. Primary an
by kimburgess 4y ago
There's a fairly excellent guide on creating a robust key system here: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide. Primary and backup Yubikey for use, offline cert keys, and paper backups.
If you're wanting to protect things further you can also also split your backups via a secret sharing scheme (like http://point-at-infinity.org/ssss/ http://point-at-infinity.org/ssss/) and distribute the fragments to people or places your at least partially trust.
- RockRobotRock 4y agoyubikey support for GPG has always been meh for me. FIDO2 ssh keys seem really promising. GPG definitely still has its place though
- kimburgess 4y agoBoth are useful. GPG is good for signing, particularly when that signature is written into some form of immutable history (e.g. git). That signing key can be revoked or time windowed to expire. There are mechanism for distributing that revocation and its validity at the time of signing can be verified at any point in the future. SSH keys are excellent for authentication. They are simple to verify at the time of use, and can also be revoked or for a specific system or usage context. Using these short-term keys for potentially long-term proofs is going to lead to some avoidable pain IMO.
- palata 4y agoOnce setup, for me it's working like a charm. I use GPG for signing (git commits + java jars/aars/apks), it just works.