Hacker News Reader

You generally do one (or both) of two things with hardware security devices:

* You buy multiple devices and configure your systems to honor both, as a backup plan.

* You back up your keys or their artifacts to paper or a small drive and keep that somewhere safe.

If you do neither of those things, and you lose the hardware key, you are either (a) boned or (b) using an insecure system where the key is just theater.

View on HN

Isn't the point of this device that it generates the private key onboard and never divulges it? Or does it have a one-way lever you have to pull at the beginning before which it's possible to sync the key to another device or download and print it?

Most devices offer a backup mechanism where the key material is encrypted and can only be imported in a same type device. For HSM'S this is called wrapping a slots key material with a wrap key. With gnupg you are allowed to export the key, or generate is on your computer and transfer it to the device.

Some services allow you to configure multiple separate keys, so different private keys. Lastpass for example.

You can literally export the RSA key from some of these keys (for backup purposes), but you can also just enroll multiple keys in whatever system you're using them with (or, you can enroll a software-based key, which you then keep only on a disconnected storage device).

Reply on news.ycombinator.com