Hacker News Reader

I actually considered that setup but decided against it. The thing is, if I did this, I would eventually succumb to convenience and would plug the key into the machine at all times. But that defeats the purpose: if a thief steals my computer they can just tap the key rather than know my password to unlock my disk.

View on HN

You normally have and you should have a fido2 pin, which is just a password. A thief would need your laptop, your security key, and the fido2 pin.

Here is an article (from yubico) about fido2 pins: https://support.yubico.com/hc/en-us/articles/4402836718866-U...

This part can be frustrating for a novice adopting security keys. The key works out of the box without PIN. If you didn't come across the right guidance, you already enrolled keys without a PIN and now discover that you need to unenroll everywhere, set a PIN, and enroll again. And even with proper backup keys etc., it can be worrying whether you've forgotten some corner case and are about to lock yourself out somewhere by setting the PIN.

Reply on news.ycombinator.com