Hacker News Reader

Comment by georgyo | Hacker News Reader

It's actually horrible! Even key rotation is horrible!

My yubikey is getting to about 10 years old, and I have replacements for it but find it very difficult to switch. It will eventually fail as an things do and it will be problematic.

The problem is that I have several dozen accounts connected to it and I don't know all of them. So either I'm carrying and trying multiple keys at all times or not getting into a site that haven't been rotated yet.

Multiple keys on an all sites is also basically impossible. You need to register all the keys, and ideally those keys are in different places.

View on HN

I’m going to need to work this out soon. I picked up a pair of new YubiKey 5Cs yesterday with their sale. I’ve been using a YubiKey Neo for years for U2F, TOTP and GPG.

Moving the GPG key is easy - though I might try using the FIDO2 support in SSH instead. However for every TOTP and U2F key I’m going to have to re-enroll the new keys… It feels like there should be a better way.

It would indeed be nice if you could "cross sign", CA style, a new yubikey with an old one, and that would somehow get passed along to the various services.

I have not thought about the various attack vectors that this may or may not enable though.

I've recently started to track my service dependency graph! So like, to keep using github I need my password store, my email and one of my two security keys. To use my email, I need...

Please contact me if you're interested, I will release the tooling I have.

FIDO2 with resident SSH ed25519 keys works great, just make sure the OpenSSH client and server versions on all the machines you’ll be using the key on support it. I wish there was a way to sign Git commits somehow using them instead of PGP.

There is as of Git 2.34 [0][1].

[0] https://github.blog/2021-11-15-highlights-from-git-2-34/#tid... [1] https://git-scm.com/docs/git-config#Documentation/git-config...

Oh nice! No more futzing around with GPG. You just made my day.

You can backup/restore FIDO2 keys via BIP39 on supported devices like a Ledger or Trezor.

Reply on news.ycombinator.com