Hacker News Reader

Comment by tptacek | Hacker News Reader

The point of an SSH key whose RSA key lives on a Y4 token is that you can't back it up; that key is tied permanently and irrevocably to a specific piece of hardware. Since you can obviously lose that token, you simply install a backup SSH key along with the Y4 key.

There are somewhat understandable reasons for wanting to back up TOTP secrets (it's a royal pain to re-enroll with a new device). But people who back up their Y4 RSA keys are sort of missing the point.

View on HN

I use my yubikey as GPG key for mail and for pass(). I really like having a backup.

You can use your yubikey to store your subkeys (still generated on the yubikey itself) while your master key is stored somewhere else. If you lose your yubikey you can revoke the subkeys and generate new ones signed by your existing master key.

With few exceptions: A) you won't be able to decrypt old messages B) you'll have to upload new public SSH keys to all servers

If you use 'pass' for storing passwords, then (A) will make your password store unavailable.

And (B) is a lot of places you have to update. In fact I aim to make it impossible to connect and update my servers key without having the existing key.

-- In short, since sub-key infrastructure really works for signatures, it seems easiest to just backup your subkeys.

My password manager, hunter2 (https://chiselapp.com/user/rkeene/repository/hunter2/ ), overcomes this by spring multiple keys per password. If you change the password then all keys that currently know the password will also be updates.

pass() can make passwords readable by multiple keys as well, but then I'd have to add the keys before loosing one. Possible, but, well, a usb stick in a safe location does the job for me currently.

> B) you'll have to upload new public SSH keys to all servers

openssh supports a CA model, so .. you can set it up so that the servers trust the CA and the CA blesses the new key. Obviously, it just shifts the "but what if we lose the .." question from the user key to the CA key, but in many cases it makes a difference.

You could also have some sort of mechanism that updates the various servers (puppet, ...) or central authentication via LDAP. SSH logins are the least of my worries. Not being able to access my passwords would suck, though :)

What email program do you use with Yubikey? I'm wanting to integrate more GPG into my email.

Thunderbird does the job. Used apple Mail with GPG for Mac before switching to Linux. That had a few glitches but was workable.

Anything that can work with GPG and GPGAgent should work with a Yubikey

Mail.app and GPGTools gives a pretty good experience if you’re on macOS

mutt works wonderfully w/ GPG.

Reply on news.ycombinator.com