But it's identical functionality to a Yubikey 4, just with type-C connector, and the product page as well as myself personally can verify that Yubikey 4 supports U2F

I'm not saying the 4C doesn't do U2F. It's the same as the 4. I'm saying that if all you want to do is log into web services, you probably don't want the Y4.

more features can even be harmful as in default OTP mode of those devices: https://hackernoon.com/avoid-leaking-your-identity-with-yubi...

Its a good thing to think about, but I don't see it as a huge problem. I had a Yubikey Nano plugged into my laptop almost constantly and I do trigger the OTP sometimes, but using that as an attack vector is pretty hard, specially for all the sticks that are not always plugged in.

Does anyone have a guide on how to store an SSH key on it? I only found PGP key guides (and I have my key on it), but not much for SSH. I also think it doesn't do ECC...

You can use the GPG key on the device for SSH authentication through gpg-agent. Here's their documentation[1] for this feature.

ECC keys should work, but haven't tried that (I use RSA-4096).

[1]: https://developers.yubico.com/PGP/SSH_authentication/

Thank you, I seem to recall trying gpg-agent but I'm not sure I went anywhere with it. Will try again.

There's this very nice guide that works well for Linux machines:

https://github.com/lfit/ssh-gpg-smartcard-config/blob/master...

I'll give that a shot, thank you!

Yes. You have to check out the PIV module. It can even be used as a CA.

https://developers.yubico.com/PIV/Guides/

There are a number of tools you can install yubico-piv-manager/yubico-piv-tool but check the guides.

I had some problems with this, somehow I could not add the key to ssh-agent, but that was related to the ssh-agent, not sure its a general problem.

Note, this does only support 2k keys. If you use the GPG Smartcard and a Authentication Subkey you can get 4k keys. The advantage of PIV is that you can actually use ssh-agent and you don't have to use gpg-agent. Gpg-agent does not have all the features that ssh-agent does, and for me that was relevant.

I prefer to keep the two separate anyways.

Thank you, this is the best guide I've seen so far. It's much simpler to install and use. However, like you, I'm having some problems. Adding the key to the ssh-agent asks for a PKCS password and always comes back with "agent refused cooperation". I also can't log in to a host that has that SSH key, but maybe that's because I have too many keys loaded...

EDIT: Never mind, it works perfectly, thanks!

This is the issue I had. I can access the key directly from the file but not add it.

How did you solve it?

This is a whole post, but basically, there are multiple SSH agents. ssh-agent supports the card and ed25519 keys, but doesn't support persisting keys across reboots. Gnome keyring supports persisting keys, but no card or ed25519 (AFAIK). gpg-agent supports persisting keys and ed25519, but no card.

Unfortunately, there's no perfect solution, so I just added an alias "yubissh" to include the library in the command line :(

Bitcoin wallet security. That's the next big thing.

what happens when you lose your yubikey? Has anyone ever lost their keys?

Better hope you have a paper backup.