Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Note that the linked guide describes the cruise/air/tilt version that includes a master identity scheme. Most people don't need to do something as complicated as all that and can just use the defaults for everything and in the end dump the private keys to the device.

Backing up the secret key material is still an issue with FIDO2.



I think idea is that you don't backup secret key material.

You should add multiple keys to your logins and have a "backup" key which is separate one.

Especially when you lose physical key, you want to have different one and revoke lost one asap.

The same with private keys generated on a device - private key should stay on the device on which it was generated and never copied. If you need access from a different device you generate private key on another device and transfer public key only to be added to account.

Which in turn also makes physical keys that you can connect to different devices a bit more convenient as private key never leaves key and is not directly accessible by laptop that it is connected to.


In PGP land it makes a lot of sense to back up your secret key material. That is because the passphrase that the user enters encrypts the secret key material. So a strong passphrase means you can backup that key anywhere and everywhere ... and probably should.

Having a strong passphrase makes things a lot simpler. A classic convenience vs security tradeoff...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: