The way I think of it is YubiKeys should be used to basically provision a computer with an approved device specific key. Whether it's a passkey or SE/TPM secured SSH/GPG/TLS key: the Yubikey holds the credential everyone trusts and therefore can be used from any device to gain access and enroll a new approved key.
replyWhy do you share private keys?
replySSH private keys should be passphrase protected.
You don’t have to do that if you use FIDO2 with a Yubikey.
Share as in storing my key in 1Password and use it from different machines. I generated the key from 1Password and don’t intend to export it.
replyYou should reevaluate if you can instead use multiple public keys where you need to connect.
replyIt’s a mind shift worth considering.
You then can accept that your ssh keys are different per hardware token (because the private key cannot be extracted).
No more sharing of private keys in your password manager.
you can’t just pop it out once you’re logged in?
replySure and pop in whenever I do a git commit? I also sign my commits. I used GPG (different key on the same hardware key) and now via SSH key. I had both a compact and bigger key. I got the compact key because my very first yubikey nearly broke. I lifted my Mac while it was connected and it cracked in the middle. I bought a compact one next which can stay inside and that one you don’t want to take out. It’s so small you’ll lose it. I know because that happened to my backup key … (that was actually the idea for the bigger one I bought but I lost the damn thing during the setup phase)
But having the yubikey bound to your Mac at all times is also stupid because it doesn’t come with a fingerprint or other biometric sensor. The idea is that you use this thing as a token not that you leave the key in the lock at all times. For that alone I would favor the enclave solution.
replyThe Yubikey 5 Nano and 5C Nano DO come with touch.
replyThe idea is precisely that you keep them permanently connected in the laptop.