On: WebAuthn – The Passwordless Future

[er4hn]

Does anyone have any suggestions for a physical token that they can use for both WebAuthN and gpg signatures?

Would be great to hear stories from people who have put the equipment "through its paces" so to say :)

[shoghicp → er4hn]

I use a Ledger for U2F/WebAuthn/GPG/SSH. Works pretty well, you can have multiple entities from a single seed. You only have to backup that seed (which can have attached passwords), and it can be recreated across any compatible device (Ledger, or Trezor, or even decode them manually)

[rendaw → er4hn]

I use a Trezor, only for stuff like this. I use it for WebAuthN, gpg, ssh, (and via gpg) password management.

Unlike Yubikey you can import an externally generated seed so you can replace a Trezor if it gets lost/breaks without registering multiple devices.

[dwaite → er4hn]

Yubikeys are good for this, as the higher end models typically support extra functionality beyond FIDO/WebAuthn, like PIV modes.

[Latty → er4hn]

I use a Yubikey for this (4C specifically), works well.

[killingtime74 → er4hn]

Yubikey?