3 ms·

Pay attention to this warning: > Transferring keys to YubiKey using keytocard is a destructive, one-way operation only. Make sure you've made a backup before p

Pay attention to this warning: > Transferring keys to YubiKey using keytocard is a destructive, one-way operation only. Make sure you've made a backup before proceeding: keytocard converts the local, on-disk key into a stub, which means the on-disk copy is no longer usable to transfer to subsequent security key devices or mint additional keys. The order of backup, transfer matters. I did a similar setup years ago before that guide existed (or before I knew about it) and ended up with a backup of nothing. Lol. Thankfully I didn’t used the key to sign anything too important and I learned the value of testing your restore procedure for everything before relying on anything.

ozim 3y ago
You know you shouldn’t move private keys around? Backup key should have separate private key and all websites should allow adding multiple keys.
- rgoulter 3y ago
  Using a 'master key' like in the DrDuh guide does avoid moving the private key around while also allowing for using the same key on multiple devices. The DrDuh guide suggests generating the key offline (e.g. a live iso), and having a backup of that private key material somewhere. In DrDuh's guide, the 'master' private key is never accessible on an online machine, only the private subkeys. An advantage with YubiKeys is that the private key material can't be re-accessed, so putting the 3 private subkeys on the YubiKey is even nicer. I'd found it hard to visualise, so came up with these diagrams: https://rgoulter.com/blog/posts/programming/2022-06-10-a-visual-explanation-of-gpg-subkeys.html https://rgoulter.com/blog/posts/programming/2022-06-10-a-vis...
- wkat4242 3y ago
  > all websites should allow adding multiple keys Yeah tell that to Paypal and a ton of other sites :(
doubled112 3y ago
I once found myself re-encrypting my entire password store because I realized my backup was not a backup at all. Better that then wait until it was too late. https://www.passwordstore.org/ https://www.passwordstore.org/

ozim 3y ago

You know you shouldn’t move private keys around? Backup key should have separate private key and all websites should allow adding multiple keys.

rgoulter 3y ago
Using a 'master key' like in the DrDuh guide does avoid moving the private key around while also allowing for using the same key on multiple devices. The DrDuh guide suggests generating the key offline (e.g. a live iso), and having a backup of that private key material somewhere. In DrDuh's guide, the 'master' private key is never accessible on an online machine, only the private subkeys. An advantage with YubiKeys is that the private key material can't be re-accessed, so putting the 3 private subkeys on the YubiKey is even nicer. I'd found it hard to visualise, so came up with these diagrams: https://rgoulter.com/blog/posts/programming/2022-06-10-a-visual-explanation-of-gpg-subkeys.html https://rgoulter.com/blog/posts/programming/2022-06-10-a-vis...
wkat4242 3y ago
> all websites should allow adding multiple keys Yeah tell that to Paypal and a ton of other sites :(

doubled112 3y ago

I once found myself re-encrypting my entire password store because I realized my backup was not a backup at all. Better that then wait until it was too late. https://www.passwordstore.org/ https://www.passwordstore.org/