Re:FIDO Alliance publishes new spec to let users move Passke...
by ycombinatrix on Wednesday October 16, 2024 @03:53PM
(#41863134)
pedantic nit: the yubikey is a device so you are arguably using one unique key per device
Re:FIDO Alliance publishes new spec to let users move Passke...
by craftkiller on Wednesday October 16, 2024 @04:06PM
(#41863267)
Haha technically true, but I don't think that was the kind of device they were referring to. Even so, it is possible to use the same key on multiple yubikeys. You generate a PGP key on a secure computer and then load that key onto multiple yubikeys. Then you use gpg as your ssh agent. But this is less secure than using keys generated on-device by the yubikey because your private key exists (hopefully temporarily) as a file on the computer where you generated it.
Re:FIDO Alliance publishes new spec to let users move Passke...
by joshuamorton on Wednesday October 16, 2024 @06:46PM
(#41864633)
No this is absolutely what I meant: A passkey and a PGP key function very similarly in this capacity, a passkey for a site can be generated on a yubikey and used across devices in just the same way.
Yes.
> you'd need some way to sync them across multiple devices securely.
I take out my physical keychain and plug in my yubikey. Then, after typing in the password to my yubikey, I can use ssh and pgp until I unplug my yubikey. It is a hell of a lot more secure than storing your ssh keys on disk regardless of whether or not you use a unique key per device. I could lock someone in a room with my computer, my yubikey, and my password, and they still wouldn't be able to copy my ssh key.