A Yubikey for SSH, GPG, and Sudo

Thu, 12 Jun 2025 11:36:00 +0000

Every private key on your laptop shares one fatal property: it is a file. Files get copied. If malware runs as your user, or a backup lands somewhere it shouldn’t, or someone walks off with the disk, your SSH private key goes with it, and a passphrase only buys you the time it takes to brute-force. The whole class of problem comes from the secret being extractable. A hardware token removes that property. The private key is generated inside a tamper-resistant chip and physically cannot leave it. The token will use the key to sign a challenge, but it will never hand the key over, to you or to anyone who steals your machine.

Hardware-Token - vo.rs

A Yubikey for SSH, GPG, and Sudo