Re:Nitrokey
by nafts on Thursday August 27, 2020 @12:31PM
(#24295355)
Can those things break? What if it does? Is all your data lost?
[ Parent
| on HN ]
In the case of Yubikey's OpenPGP smartcard emulation, you can generate the key on a computer, write it to the Yubikey, then do whatever kinds of backups of the keys you like. If the Yubikey is destroyed or lost, you can buy a new one and write the key to it from a backup.
If I recall correctly, writing the key is an OpenPGP smartcard feature, so it should work on any hardware key that supports acting as an OpenPGP smartcard.
Re:Nitrokey
by foxtrottbravo on Thursday August 27, 2020 @03:22PM
(#24297566)
The Yubikey documentation recommends always buying them at least in pairs. And configure them both for access.
If you use either a Static Password an HMAC-SHA1 Challenge-Response or TOTP with the key you can easily backup the secret material used to program the key and replace the key if one fails.
Store backups safely.
I would assume that you can have more than one so you have a backup, but if not, yeah that seems like a serious single point of failure.
For Nitrokey Start and Pro: Only during generation of key, it can be backed up.
The Nitrokey HSM supports encrypted backups of keys.
I've had a Yubikey on my main keychain for about 5 years. I dropped it dozens of time and it never broke.
Same here; the YKs on my keychain take an incredible amount of abuse, rubbing against keys and other objects all day long, for years, and I've never had any trouble. Contacts don't show appreciable wear (and they've had thousands of insertions).
One thing I'd really, really like is for a way to distinguish multiple YKs. The things are so durable that they won't take a permanent marker, and I've had to gouge identifiers on them, clip off corners and so forth.
I used a hand-held label printer to make labels for mine. It's only on the one I have labeled as my "backup" so it doesn't get beat up too much though.
Re: that last point, they do offer various skins you can apply to the keys, though I don't know how durable they are.