Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Signing with a separate hardware-stored SSH key on a dongle (e.g.: Yubikey/FIDO2) will allow you to have a long-lived key without the risk of compromise.


If you're using a dongle, I expect you'd have your other SSH keys there as well. Is there a security benefit to using a separate SSH key if they all live on the same dongle? I'm having trouble thinking through that. Although, certainly the hardware dongle has security benefits over SSH keys on disk.


Yes -- you can separate identities if you want, and rotating keys means changing a lot less places, so you can compartmentalize your processes.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: