Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Hah, I saw this just after sending a newsletter issue on my password management solution, which is based on passage [1] (a fork of password-store [2] that uses age [3]) and YubiKeys.

My age+YubiKeys Password Management Solution — https://words.filippo.io/dispatches/passage/

The main feature is some protection against post-compromise exfiltration: even if an attacker fully compromises my laptop, they can't extract the whole vault.

[1]: https://github.com/FiloSottile/passage

[2]: https://www.passwordstore.org

[3]: https://age-encryption.org



Very cool! Thanks for all your work!

I was waiting for a solution to store age keys on a security key, and it's great that it's now possible with YubiKeys.

I currently use smart cards to store my GPG keys, which works even on Android, as there are some that support NFC, so I can use them with the OpenKeychain and Password Store apps. I need to have passwords available on mobile, as often when I'm traveling I don't want to lug around a laptop. The QR code solution you suggest doesn't seem optimal.

Would it be possible to achieve the same workflow with age and NFC YubiKeys? I suppose it would need a native mobile app for that to work.


If using the OpenPGP applet over NFC is possible, then it's almost certainly possible to use the PIV one with age keys too!

The Andorid password-store app is working on an implementation of age in Kotlin (https://github.com/android-password-store/kage) and I think they already support passage stores. Maybe you could open a feature request for age-plugin-yubikey compatibility? If you do, feel free to tag me, and I can help make sure the formats are well specified.


I updated to 1.1.1 yesterday and hope to try with a Yubikey here soon.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: