Hacker News Reader

Yubikey + OpenGPG + Enable SSH support on your gpg agent

Unless I'm missing something, that essentially solves the issue, no? Persistent private key, usable across all your machines that can't be exfiltrated. Bonus since you can even generate the key directly on the device!

This gets even easier with newer OpenSSH versions if you use FIDO2 auth for SSH. I've not played with it personally, but word is you just plug in the key and off you go

View on HN

For a single person that a pretty good solution just make sure you backup you SSH key so you can recover if you lose your yubikey.

In a multi-person enterprise the issue becomes how to manage all these keys with on-boarding, off-boarding, logs, access policies as people's roles change. Maybe someone only needs access for a day? How do you ensure their key is removed tomorrow morning. Maybe someone never setup their yubikey and their SSH key is just living on their laptop and backed up to dropbox. SSH is a great solution for individuals but I've encountered so many anti-patterns when used among large teams.

Reply on news.ycombinator.com