Hacker News Reader

Comment by bpye | Hacker News Reader

I’m going to need to work this out soon. I picked up a pair of new YubiKey 5Cs yesterday with their sale. I’ve been using a YubiKey Neo for years for U2F, TOTP and GPG.

Moving the GPG key is easy - though I might try using the FIDO2 support in SSH instead. However for every TOTP and U2F key I’m going to have to re-enroll the new keys… It feels like there should be a better way.

View on HN

I've recently started to track my service dependency graph! So like, to keep using github I need my password store, my email and one of my two security keys. To use my email, I need...

Please contact me if you're interested, I will release the tooling I have.

It would indeed be nice if you could "cross sign", CA style, a new yubikey with an old one, and that would somehow get passed along to the various services.

I have not thought about the various attack vectors that this may or may not enable though.

FIDO2 with resident SSH ed25519 keys works great, just make sure the OpenSSH client and server versions on all the machines you’ll be using the key on support it. I wish there was a way to sign Git commits somehow using them instead of PGP.

There is as of Git 2.34 [0][1].

[0] https://github.blog/2021-11-15-highlights-from-git-2-34/#tid... [1] https://git-scm.com/docs/git-config#Documentation/git-config...

Oh nice! No more futzing around with GPG. You just made my day.

You can backup/restore FIDO2 keys via BIP39 on supported devices like a Ledger or Trezor.

Reply on news.ycombinator.com