News for hackers. Stuff that matters.
Re:Using a Yubikey for GPG and SSH by lrvick on Sunday January 14, 2018 @03:18PM (#16146135)
I feel the author missed a critical step.

You want to enable user interaction flags to defend against someone with remote access to your machine.

  $ ykman openpgp touch aut fix
  $ ykman openpgp touch enc fix
  $ ykman openpgp touch sig fix
This will require the yuibikey be physically touched for each sign/decrypt/ssh operation which while simple is something a remote attacker can't perform.

For more detailed notes from me deploying commit signing and ssh via yubikey at three orgs see: https://github.com/lrvick/security-token-docs

* Edit: you want to use "fix" instead of "on" to prevent an attacker from just turning it off again.

Re:Using a Yubikey for GPG and SSH by jlgaddis on Sunday January 14, 2018 @03:20PM (#16146146)
Instead of using those backticks (which don't work here), indent each line by two spaces. It'll render like this:

  $ ykman openpgp touch aut fix
  $ ykman openpgp touch enc fix
  $ ykman openpgp touch sig fix
Edited after parent's edit: s/on$/fix/g
Re:Using a Yubikey for GPG and SSH by lrvick on Sunday January 14, 2018 @03:43PM (#16146287)
Fixed, thanks.
Re:Using a Yubikey for GPG and SSH by lima on Sunday January 14, 2018 @06:59PM (#16147367)
Warning: "fix" is permanent.

(that's the whole point of it)

Re:Using a Yubikey for GPG and SSH by atmoz on Tuesday January 16, 2018 @07:39AM (#16157737)
> you want to use "fix" instead of "on" to prevent an attacker from just turning it off again.

An attacker also must know you admin PIN (required to change this setting), so there is really no need to use "fix" instead of "on". To be able to toggle this off, you must reset your yubikey (paraphrasing the docs).