Hacker News new | past | comments | ask | show | jobs | submit login

I'd love to, but I keep keys on my Yubikey - which only supports 1 auth key. Even using U2F for SSH keeps the same restrictions. And using a different yubikey for various services isn't ideal either.

I have considered keeping encrypted keys in my password manager per-service, and decrypt+add them to my SSH agent when they're used to offer almost the same guarantees.




> Even using U2F for SSH keeps the same restrictions

Er, what? The SSH keys are being generated the same way keys for web sites are under FIDO, which is to say they're random - your physical device has no idea how many keys you have, it couldn't mandate that there's only one key if it tried. It only knows how to tell if these are keys it made (otherwise presumably a different FIDO authenticator made them) and if so use them to sign you in once somebody touches the contact.


That makes sense. I need to try U2F for SSH more thoroughly I guess.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: