3 ms·
I don't know how difficult it would be to obtain the key from the device. However, if you have a strong passphrase on the key itself, then even if an attacker o
by w8rbt 11y ago
I don't know how difficult it would be to obtain the key from the device. However, if you have a strong passphrase on the key itself, then even if an attacker obtained the key, there would not be a lot to worry about. Just revoke it and move on. They'll likely never guess the passphrase.
- e12e 11y agoIf you're that confident in your pass-phrase, you could just push your private key to github. Might want to consider that there is some overlap between being able to steal your yubi-key, and being able to install a hardware (or software) key logger...
- mrsteveman1 11y agoThe passphrase you set on a GPG private key only applies to keys stored on-disk in the keychain or exported from the keychain. Once you import one into a Yubikey or other OpenPGPCard device, there is no passphrase anymore, you're relying on the card itself to protect it against side-channel attacks, prevent unauthorized or insecure export of the key (Yubikeys don't allow this at all though), and authorize the use of it via the PIN code.
- w8rbt 11y agoThanks for that explanation. I've never placed any of my GPG keys on a Yubikey. I just assumed that the key password remained.