Hacker News Reader

Thanks, this looks interesting. Are you using Yubikeys or something else?

https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...

Both. FIDO2 compliant devices need to implement ECDSA at minimum, which means you can use non-discoverable keys for SSH at minimum.

Yubikeys, and some others, also implement Ed25519 and discoverable key storage, so you can store SSH keys on the Yubikey itself.

Yes be aware that the discoverable slots are very limited (I forget but I think it's 8) and they are also used for passwordless use with websites. There's no way to reassign those slots right now short of wiping the whole key.

At least with Yubikeys, there are 25 discoverable key slots and you're able to pick and choose which keys you want to delete or save at any time using the Yubico Authenticator.

Hmm I don't have that option. Perhaps my firmware is too old. Unfortunately Yubikeys can't be updated anymore since the early NEOs :(

I use a Google Titan key for this purpose, have a ssh key password that I can "cache" for the session on my macos key chain, but I have to tap the Titan key for every pull/push

Reply on news.ycombinator.com