That was my first thought, too — this might work as one of additional methods of logging in, but not as the only one.

I have been using YubiKeys for many years now, following this guide: https://github.com/drduh/YubiKey-Guide

This means I can have secure private keys for ssh and gpg (cue the crowd saying gpg is insecure without offering good modern alternatives), which I can also back up. And I can set up multiple YubiKeys, which I do.

An additional advantage of this solution is that you can set your YubiKey to require a touch confirmation before performing an operation. This makes it much harder for runaway AI agents to wreak havoc on your servers: there is a physical limitation, which I really like.

You aren't supposed to be moving SSH keys. They should stay on the machine they were generated on. The less accessible they are the better.

I really wouldn't rely on an SSH key as the sole way of accessing a machine.

I very much prefer to have one key per device! That allows for fine grained access control. In general I wouldn’t export private keys unless really necessary.

Yes I don't see how that's helpful.

It's quite opposite of what I'd want.

If you use a trezor hardware wallet (and probably other hardware wallets) you can deterministically regenerate -sk keys.

I use trezors various agents for AGE, FIDO2/passkey, ssh[0].

But you still need the backup some bits of material like stubs for some FIDO keys (not secret material) that need importing into fresh trezor devices.

It's approaching the never lose a key again levels.

Of course, I won't pretend there isn't an obvious issue. What if you lose the seed words or someone gains access. What if the software becomes incompatible, or trezor devices become expensive/change etc.

[0] https://github.com/romanz/trezor-agent

You could generate an additional backup key pair, add to authorized_keys on remote hosts in additional to the stored in enclave key, test then backup and wipe from your macbook (to reduce compromise risk).

Yes, this only works if you can register more than 1 ssh keys on the services you want.

It's literately TWO shell commands? One for generating the key in the secure enclave and one for adding it to ssh-agent?

I've been using Secretive for years because I didn't bother looking it up how to do it without. I think this is worth doing without an additional third party, especially since it's only a few commands.

Your backup key should also be in a secure enclave, just in a different secure enclave. Both keys should be accepted by the system.

The truly paranoid can multiple types of secure enclaves - TouchID for primary, a YubiKey for backup.

> If need be on paper

Your security is only as strong as its weakest link. Paper has a way of getting photographed, and the privacy of your key depends on your OCR software, unless you really want to painstakingly copy it in by hand, and even then, it turns into a file-based key on the filesystem, with all its attendant risks.

That would make it extractable and syncable to other hosts. That's fine if that's what you want but it's an important distinction.

I am doing the same, such a great underrated feature that many people do not know of.

It’s a new feature! In Tahoe & Golden Gate at the very least FIDO is supported by the SSH agent

If you lose a Yubikey you also lose the... key.

Thank you for raising this, as it predates TFA by a year, and also correctly cites their source.