Hacker News Reader

Comment by Xylakant | Hacker News Reader

I use my yubikey as GPG key for mail and for pass(). I really like having a backup.

You can use your yubikey to store your subkeys (still generated on the yubikey itself) while your master key is stored somewhere else. If you lose your yubikey you can revoke the subkeys and generate new ones signed by your existing master key.

With few exceptions: A) you won't be able to decrypt old messages B) you'll have to upload new public SSH keys to all servers

If you use 'pass' for storing passwords, then (A) will make your password store unavailable.

And (B) is a lot of places you have to update. In fact I aim to make it impossible to connect and update my servers key without having the existing key.

-- In short, since sub-key infrastructure really works for signatures, it seems easiest to just backup your subkeys.

> B) you'll have to upload new public SSH keys to all servers

openssh supports a CA model, so .. you can set it up so that the servers trust the CA and the CA blesses the new key. Obviously, it just shifts the "but what if we lose the .." question from the user key to the CA key, but in many cases it makes a difference.

You could also have some sort of mechanism that updates the various servers (puppet, ...) or central authentication via LDAP. SSH logins are the least of my worries. Not being able to access my passwords would suck, though :)

My password manager, hunter2 (https://chiselapp.com/user/rkeene/repository/hunter2/ ), overcomes this by spring multiple keys per password. If you change the password then all keys that currently know the password will also be updates.

pass() can make passwords readable by multiple keys as well, but then I'd have to add the keys before loosing one. Possible, but, well, a usb stick in a safe location does the job for me currently.

What email program do you use with Yubikey? I'm wanting to integrate more GPG into my email.

mutt works wonderfully w/ GPG.

Thunderbird does the job. Used apple Mail with GPG for Mac before switching to Linux. That had a few glitches but was workable.

Anything that can work with GPG and GPGAgent should work with a Yubikey

Mail.app and GPGTools gives a pretty good experience if you’re on macOS

Reply on news.ycombinator.com