Re:Apple, Google and Microsoft Commit to Expanded Support fo...
by bpye on Thursday May 05, 2022 @12:52PM
(#31275730)
I’m going to need to work this out soon. I picked up a pair of new YubiKey 5Cs yesterday with their sale. I’ve been using a YubiKey Neo for years for U2F, TOTP and GPG.
Moving the GPG key is easy - though I might try using the FIDO2 support in SSH instead. However for every TOTP and U2F key I’m going to have to re-enroll the new keys… It feels like there should be a better way.
Re:Apple, Google and Microsoft Commit to Expanded Support fo...
by andrey_utkin on Thursday May 05, 2022 @01:24PM
(#31276138)
I've recently started to track my service dependency graph! So like, to keep using github I need my password store, my email and one of my two security keys. To use my email, I need...
Please contact me if you're interested, I will release the tooling I have.
Re:Apple, Google and Microsoft Commit to Expanded Support fo...
by bradstewart on Thursday May 05, 2022 @01:13PM
(#31276013)
It would indeed be nice if you could "cross sign", CA style, a new yubikey with an old one, and that would somehow get passed along to the various services.
I have not thought about the various attack vectors that this may or may not enable though.
Re:Apple, Google and Microsoft Commit to Expanded Support fo...
by _vdpp on Thursday May 05, 2022 @02:14PM
(#31276741)
FIDO2 with resident SSH ed25519 keys works great, just make sure the OpenSSH client and server versions on all the machines you’ll be using the key on support it. I wish there was a way to sign Git commits somehow using them instead of PGP.
Re:Apple, Google and Microsoft Commit to Expanded Support fo...
by jameswryan on Friday May 06, 2022 @09:59AM
(#31285161)
There is as of Git 2.34 [0][1].
[0] https://github.blog/2021-11-15-highlights-from-git-2-34/#tid... [1] https://git-scm.com/docs/git-config#Documentation/git-config...
My yubikey is getting to about 10 years old, and I have replacements for it but find it very difficult to switch. It will eventually fail as an things do and it will be problematic.
The problem is that I have several dozen accounts connected to it and I don't know all of them. So either I'm carrying and trying multiple keys at all times or not getting into a site that haven't been rotated yet.
Multiple keys on an all sites is also basically impossible. You need to register all the keys, and ideally those keys are in different places.