Hacker News Reader

Comment by StewardMcOy | Hacker News Reader

I don't see the benefit of using certificates for personal use. In my mind, certificates only really shine when administering a fleet of servers in a large company, as it eliminates the need to update the authorized_keys file on every server someone is hired or leaves.

I could be missing some less obvious use cases, but if you're just authenticating to your personal machines, it doesn't seem worth it. It's not any more secure than SSH keys, and you have to also manage and secure your CA key.

View on HN

I think this is true if you only really have one or two computers you use ssh from regularly but if you have a few or you get new ones frequently you can get back to that experience of not having to frequently generate and distribute public keys by using a yubikey to sign local keys and then your authorized_keys only needs the cert authorization in it.

I just store my SSH key in my Yubikey and then I can SSH from any computer that has SSH and GPG installed. Gets rid of the "generate and sign a key that then sits on that computer that might not be fully trusted" step...

not as flexible, as it has more dependencies, but you can make it work without gpg as well: https://developers.yubico.com/yubico-piv-tool/YKCS11/

Yes, I could. In fact I actually also use the PIV functionality, just not for SSH. The GPG answer seems simpler, at least for my use-case, since it really does just require SSH and GPG (okay, and GPG configured to `enable-ssh-support`). Also, I was actually using a GPG-as-SSH-key before I started hosting it on my Yubikey.

Sadly, the Windows GPG build and Win32-OpenSSH don't talk to the agent the same way, so it doesn't work there. (AFAIR Windows GPG - and Putty - uses "Assuan" while Win32-OpenSSH uses named pipes just like *nix SSH/GPG do.) I don't think PIV would help that though :(

I hadn't thought of storing the CA key on the YubiKey. That's an interesting way to go about it.

Like the other reply though, I keep my private SSH key on the YubiKey, protected with both a PIN and a password. I can SSH from any computer as long as I can install gpg on it.

Most of the time I don't really want to have my yubikey on me all the time (in particular, I no longer have need of regular keys in my day to day life so my keychain isn't as important as it once was). I'm happy enough to put a cert on a key, maybe with an expiry time, every now and then or on first use.

And it means I have to care less about what agent I'm running most of the time.

I agree, but it kinda depends. For me, my personal setup has 8 things I can ssh to. It's not that big a deal to update them all if I get a new laptop or need to rotate my key. But I can certainly understand if someone didn't feel like doing that 8 times and wanted to use certs.

Reply on news.ycombinator.com