Hacker News Reader

I hadn't thought of storing the CA key on the YubiKey. That's an interesting way to go about it.

Like the other reply though, I keep my private SSH key on the YubiKey, protected with both a PIN and a password. I can SSH from any computer as long as I can install gpg on it.

View on HN

Most of the time I don't really want to have my yubikey on me all the time (in particular, I no longer have need of regular keys in my day to day life so my keychain isn't as important as it once was). I'm happy enough to put a cert on a key, maybe with an expiry time, every now and then or on first use.

And it means I have to care less about what agent I'm running most of the time.

Reply on news.ycombinator.com