undefined | Better HN

0 pointsSpunkie1y ago0 comments

I would say the exact opposite, traditional ssh key management should eventually give way to resident keys. Aka, treating them just like passkeys.

We've been storing ssh keys directly on our yubikeys since before passkeys were a thing.

Not only is it clearly more secure it's also been a usability lift. Plugin your yubikey, start an ssh agent, and run ssh-add -K to get all your resident keys added to your current session.

0 comments

Ferret74461y ago

I might add, you can already do this. OpenSSH has had FIDO support for a while now. I've found it to work better than trying to use PGP or PIV/PKCS#11

j / k navigate · click thread line to collapse

0 pointsSpunkie1y ago0 comments

I would say the exact opposite, traditional ssh key management should eventually give way to resident keys. Aka, treating them just like passkeys.

We've been storing ssh keys directly on our yubikeys since before passkeys were a thing.

Not only is it clearly more secure it's also been a usability lift. Plugin your yubikey, start an ssh agent, and run ssh-add -K to get all your resident keys added to your current session.

0 comments

Ferret74461y ago

I might add, you can already do this. OpenSSH has had FIDO support for a while now. I've found it to work better than trying to use PGP or PIV/PKCS#11

j / k navigate · click thread line to collapse