The discussion centers on the trade-offs between using macOS Secure Enclave for SSH keys versus traditional methods, with users praising the hardware-bound security but criticizing the lack of portability and backup capabilities. Strong disagreements arise regarding whether the biometric requirement is a feature or a bug for automation, and if the perceived security benefits outweigh the usability friction compared to passphrase-protected keys.
139 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4drduh
YubiKey-Guide
HTML2016–2026
drduh / YubiKey-Guide
YubiKey-Guide
Community guide to using YubiKey for GnuPG and SSH - protect secrets with hardware crypto.
38Distinct people
59Mentions
2Explicit recommenders
13.1KGitHub stars
What to know before exploring
What it is
Community guide to using YubiKey for GnuPG and SSH - protect secrets with hardware crypto.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
I haven't tried using the GPG mode on mobile, but I've had absolutely 0 issues with it on Linux. Just followed the arch wiki setup and this random guide I found:…
vladvasiliu used a recommendation phrase. 4 indexed comments match. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 10:01:16 PM UTC.
Mentions over time
HN mentions by year59 dated mentions
Observed mentions: 2016-02-02 12:15:55 UTC to 2026-10-30 08:31:13 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 13 | 1 | 12 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 7 | 1 | 6 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 9 | 1 | 8 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 10 | 1 | 9 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 4 | 1 | 3 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
This guide demonstrates how to store credentials on a YubiKey. The private keys cannot be copied back out of the device. Keys are first generated on an offline computer, then exported to encrypted offline backups, and then transferred to YubiKey for daily use. If the YubiKey is lost, stolen, or destroyed, keys can be restored from an encrypted backup to a new device.
Purchase YubiKey
Prepare setup environment
Download and verify Debian
Create bootable USB device
Prepare hardware
Install software
Prepare GnuPG
Configuration
Identity
Key algorithm
Expiration
Passphrase
Create Certify key
Create Subkeys
Verify keys
Backup keys
Export public key
Configure YubiKey
Change PIN
Set attributes
Transfer Subkeys
Signature key
Encryption key
Authentication key
Verify transfer
Finish setup
Using YubiKey
Encryption
Signature
Configure touch
SSH
Replace agents
Copy public key
Import SSH keys
SSH agent forwarding
Use ssh-agent
Use S.gpg-agent.ssh
Chained forwarding
GitHub
GnuPG agent forwarding
Legacy distributions
Chained GnuPG agent forwarding
Using multiple YubiKeys
Email
Thunderbird
Mailvelope
Mutt
Keyserver
Updating keys
Renew Subkeys
Rotate Subkeys
Reset YubiKey
Optional hardening
Improving entropy
Enable KDF
Network considerations
Notes
Troubleshooting
Alternative solutions
Additional resources
Purchase YubiKey
Choose a YubiKey model that includes the OpenPGP application. YubiKey Security Key and YubiKey Bio models do not include OpenPGP support and cannot be used with this guide.
Verify the YubiKey at yubico.com/genuine. Select Verify Device, touch the key when prompted, and allow the site to identify the device model. This can help detect some supply chain tampering.
Have at least two USB drives or microSD cards for storing encrypted offline backups in different physical locations.
Prepare setup environment
Use a dedicated, hardened environment to generate the keys and backups.
The following environments are ordered from least to most secure for this task:
Public, shared or other computer owned by someone else
Daily-use personal operating system with unrestricted network access
Virtualized system with limited capabilities (using virt-manager, VirtualBox or VMware, for example)
Dedicated and hardened Debian or OpenBSD installation
Ephemeral Debian Live or Tails booted without primary storage attached
Hardened hardware and firmware (e.g., Coreboot, Intel ME removed)
Air-gapped system without network capabilities, preferably ARM-based Raspberry Pi or other architecturally diverse equivalent
Network isolation and dedicated hardware generally provide stronger protection than a daily-use online system. For most people, booting Debian Live from USB on a personal computer is a practical baseline.
Download and verify Debian
Download the latest Debian Live image and signature files. These commands download the checksum file, its signature, and the current 64-bit XFCE Live ISO:
imageUrl="https://cdimage.debian.org/debian-cd/current-live/amd64/iso-hybrid/"
curl -sfL -O "$imageUrl/SHA512SUMS" -O "$imageUrl/SHA512SUMS.sign"
curl -sfLO "$imageUrl/$(awk '/xfce\.iso$/ {print $NF}' SHA512SUMS)"
Download the Debian signing public key:
gpg --keyserver hkps://keyring.debian.org \
--recv DF9B9C49EAA9298432589D76DA87E80D6294BE9B
If the public key cannot be received, use a different keyserver or DNS server:
gpg --keyserver hkps://keyserver.ubuntu.com:443 \
--recv DF9B9C49EAA9298432589D76DA87E80D6294BE9B
The Debian Live signing public key is also available for import in pubkeys:
gpg --import pubkeys/debian-DA87E80D6294BE9B.asc
Verify the signature:
gpg --verify SHA512SUMS.sign SHA512SUMS
Confirm the fingerprint matches Debian's published fingerprint:
gpg: Good signature from "Debian CD signing key <debian-cd@lists.debian.org>"
Verify the image hash matches the signed sums file:
grep $(sha512sum debian-live-*-amd64-xfce.iso) SHA512SUMS
See Verifying authenticity of Debian CDs for more information.
Create bootable USB device
Connect a storage device and identify the device path. This guide uses /dev/sdc throughout, but this value may differ on your system.
WarningThe following dd commands erase and overwrite the selected device. Check the device path before continuing!
Linux
$ sudo dmesg | tail
usb-storage 3-2:1.0: USB Mass Storage device detected
sd 2:0:0:0: [sdc] Attached SCSI removable disk
Copy the Debian image to the device:
sudo dd if=debian-live-*-amd64-xfce.iso of=/dev/sdc bs=4M status=progress ; sync
OpenBSD
$ dmesg | tail -n2
sd2 at scsibus4 targ 1 lun 0: <TS-RDF5, SD Transcend, TS3A> SCSI4 0/direct removable serial.0000000000000
sd2: 15193MB, 512 bytes/sector, 31116288 sectors
$ doas dd if=debian-live-*-amd64-xfce.iso of=/dev/rsd2c bs=4m
465+1 records in
465+1 records out
1951432704 bytes transferred in 139.125 secs (14026448 bytes/sec)
Prepare hardware
Shut down the computer that will be used to generate keys.
Disconnect internal storage and unnecessary peripherals, such as the wireless card.
Install software
Boot the computer from the Debian Live USB drive.
Configure networking to install the required software; see Network considerations for optional restrictions.
TipIf the screen locks on Debian Live, unlock with user / live
Open a terminal and install the required software.
Debian/Ubuntu
sudo apt update
sudo apt -y upgrade
sudo apt -y install \
wget gnupg2 gnupg-agent dirmngr \
cryptsetup scdaemon pcscd \
yubikey-personalization yubikey-manager
OpenBSD
doas pkg_add gnupg pcsc-tools
macOS
Download and install Homebrew and the following packages:
brew install gnupg yubikey-personalization ykman pinentry-mac wget
Or using MacPorts, install the following packages:
sudo port install gnupg2 yubikey-manager pinentry wget
NixOS
Use this repository's purpose-built live ISO instead of Debian Live. Copy the resulting ISO to a USB drive, boot from it, and keep the system offline while generating keys.
ref=$(git ls-remote https://github.com/drduh/Yubikey-Guide refs
Read the full README on GitHubWhat Hacker News says
13 sourcesNice repo.
For those starting from scratch with a YubiKey I always recommend this guide:
https://github.com/drduh/YubiKey-Guide
Then they know how this stuff works and how to fix it when it breaks.
In Show HN: GPG on macOS and YubiKeyWhat are the biggest advantages/improvements over generating a "classic" private/public keypair with for example a Yubikey [1]?
[1] https://github.com/drduh/YubiKey-Guide
In OpenSSH's Support for U2F/Fido SecurityThere's also DrDuh's pretty comprehensive guide https://github.com/drduh/YubiKey-Guide
In Getting Started with Security KeysAs an alternative solution to the SSH key security concerns raised here, I use a Yubikey as a smart card for my SSH access. This way, even if my laptop is compromised, an attacker has to physically steal my Yubikey (and know the PIN on it).
If interested, I followed this guide to set it up: https://github.com/drduh/YubiKey-Guide/blob/master/README.md
In Public keys are not enough for SSH securityGuide to Using YubiKey for GPG and SSH
2 points · Open discussionThere are sites that show how to move your key to multiple Yubikeys. (Basically, backup your keyring before moving to Yubikey, then restore and repeat move to a new Yubikey).
This is the guide I followed: https://github.com/drduh/YubiKey-Guide
In Stupid Unix TricksEither the USB-A dongle or the USB-C one should work in all of these cases with an additional dongle (sigh).
By the way: I recommend getting the larger keys, not the nanos. These nanos look cute, but especially the newer ones are intended to be fixed to one device permanently, which in my opinion is both inconvenient and not the intended usage.
I wonder if iPad apps will start supporting Yubikeys — especially with the new iPad pros and their USB-C port it seems natural.
Ideally, I'd love to see Blink integrate ssh-agent, gpg-agent and its card support, which would let me use my existing (excellent) setup for using GPG keys stored on a Yubikey for ssh (see https://github.com/drduh/YubiKey-Guide for a great writeup of this approach).
In Support for U2F security keysAnother plug for: https://github.com/drduh/YubiKey-Guide
In Using a Yubikey as smartcard for SSH public key authenticationIf you are OK with using PGP keys, there is an excellent guide at https://github.com/drduh/YubiKey-Guide — I've been using this kind of setup for almost a year now and it works really, really well. Highly recommended.
Be sure to set the Yubikey to require touch.
As a side note, the author writes:
> GnuPG's user interface is a disaster
Well, I'd say the procedure described in the article is a strong contender, too :-)
In Using a Yubikey as smartcard for SSH public key authenticationI basically followed drduh's guide mentioned above. In particular, for the touch feature there is this subsection: https://github.com/drduh/YubiKey-Guide#touch-to-authenticate
See also: https://developers.yubico.com/PGP/Card_edit.html
In Using a Yubikey as smartcard for SSH public key authenticationFor a different approach (this approach is mentioned briefly at the beginning of the post, and dismissed with "I did not like that very much"), see also drduh's Yubikey guide: https://github.com/drduh/YubiKey-Guide#ssh
Note that the PIV approach used in the OP does not support RSA4096, while the OpenPGP approach does (since Yubikeys support RSA4096 in OpenPGP mode but not in PIV mode).
In Using a Yubikey as smartcard for SSH public key authenticationI'm not sure but it would come down to if openpgp supports that.
A quick Google shows this: https://github.com/drduh/YubiKey-Guide
I didn't read everything but it seems pretty comprehensive.
In Password Managers: Under the Hood of Secrets ManagementHere’s a decent guide: https://github.com/drduh/YubiKey-Guide
PS I’d love to get some shoved into my hand. Paid $100 for my pair.
In Ask HN: Do you use a GPG key with GitHub?