2 ms·

Thanks, this looks interesting. Are you using Yubikeys or something else? https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html https://developers.yub

• ikornaselur 3y ago
  I use a Google Titan key for this purpose, have a ssh key password that I can "cache" for the session on my macos key chain, but I have to tap the Titan key for every pull/push
• heavyset_go 3y ago
  Both. FIDO2 compliant devices need to implement ECDSA at minimum, which means you can use non-discoverable keys for SSH at minimum. Yubikeys, and some others, also implement Ed25519 and discoverable key storage, so you can store SSH keys on the Yubikey itself.
  • wkat4242 3y ago
    Yes be aware that the discoverable slots are very limited (I forget but I think it's 8) and they are also used for passwordless use with websites. There's no way to reassign those slots right now short of wiping the whole key.
    • heavyset_go 3y ago
      At least with Yubikeys, there are 25 discoverable key slots and you're able to pick and choose which keys you want to delete or save at any time using the Yubico Authenticator.
      • wkat4242 3y ago
        Hmm I don't have that option. Perhaps my firmware is too old. Unfortunately Yubikeys can't be updated anymore since the early NEOs :(