Hacker News Reader

Comment by jwr | Hacker News Reader

That was my first thought, too — this might work as one of additional methods of logging in, but not as the only one.

I have been using YubiKeys for many years now, following this guide: https://github.com/drduh/YubiKey-Guide

This means I can have secure private keys for ssh and gpg (cue the crowd saying gpg is insecure without offering good modern alternatives), which I can also back up. And I can set up multiple YubiKeys, which I do.

An additional advantage of this solution is that you can set your YubiKey to require a touch confirmation before performing an operation. This makes it much harder for runaway AI agents to wreak havoc on your servers: there is a physical limitation, which I really like.

View on HN

I don't get it even after reading the guide. How do you deal with backups when using YubiKeys? The private key is stored on the YubiKey with no ability to export it, ok... then what do you do when you lose the YubiKey?

Are you supposed to have multiple YubiKeys (multiple private keys) and then ensure that all your systems accept the matching multiple pubkeys?

The guide's Backup section is... super vague. It says exporting keys, of which some are private keys, which I thought shouldn't be possible?? And then it goes off about partitioning and filesystems?

Yes, you have multiple Yubikey's and store them independently.

> How do you deal with backups when using YubiKeys

You generate your gpg key on a computer, back it up securely, then store it in the YubiKey and delete the unprotected version on the computer.

This allows you to have multiple YubiKeys with the same private key.

However, nothing prevents you from generating private keys on the YubiKey and using multiple Yubikeys. Or doing a combination of the two approaches.

I too use (multiple) yubikey to hold my private gpg keys.

But I am not sure I will stick with gpg though.

Even with my system to extend their expiration or renew them. I have found handling them to be a pain.

I use them for 2 things: encrypt/decrypt gopass secrets and sign git commits.

Gopass now has more than decent age support. A yubikey can hold an age key.

Most git forges accept a ssh key to sign commits. A yubikey can hold a ssh key.

So, for my needs, I think I could leave the operational complexities (to me) of gpg and go for alternatives that are simpler.

You should never have a single ssh key as mean to login anyway. My keys never leave device that created them, but every device has its own pair, plus yubikey-like key.

You don't even need a YubiKey to have an authentication subkey.

Just a random site - https://opensource.com/article/19/4/gpg-subkeys-ssh

Reply on news.ycombinator.com