enable-a-hardware-security-key
goal:
what you need
- two hardware keys that support FIDO2 or WebAuthn: one primary, one backup[cite: 3, 4, 5, 6]
- your password manager, open and unlocked[cite: 3, 4, 5, 6]
- a list of accounts to protect, starting with:
- your primary email[cite: 3, 4, 5, 6]
- your password manager[cite: 3, 4, 5, 6]
- your phone carrier or Apple, Google, or Microsoft account[cite: 3, 4, 5, 6]
steps
- Start with email. Whoever controls your email can usually reset every other password, so protect it first.[cite: 3, 4, 5, 6]
- Open the account’s security settings and look for security key, passkey, or two-step verification.[cite: 3, 4, 5, 6]
- Choose to add a key. When asked, insert it or tap it, then give it a name such as
primary-keyring.[cite: 3, 4, 5, 6] - Repeat with the second key and name it
backup-safe. Store it somewhere other than your daily key.[cite: 3, 4, 5, 6] - Save any recovery codes the service offers into your password manager.[cite: 3, 4, 5, 6]
- Test it: sign out, then sign back in using the key. Press Esc if a prompt gets stuck and try again.[cite: 3, 4, 5, 6]
using a key for ssh
If you log in to servers over SSH, you can make a key that only works while the hardware key is plugged in. This needs OpenSSH 8.2 or newer.[cite: 3, 4, 5, 6]
ssh-keygen -t ed25519-sk -C "primary-keyring"
cat ~/.ssh/id_ed25519_sk.pubAdd the printed public key to your server’s authorized_keys file, then test a login before closing your current session.[cite: 3, 4, 5, 6]
why two keys
If losing one key would lock you out, that key is a single point of failure.[cite: 3, 4, 5, 6]
| key[cite: 3, 4, 5, 6] | lives[cite: 3, 4, 5, 6] | used for[cite: 3, 4, 5, 6] |
|---|---|---|
| primary[cite: 3, 4, 5, 6] | on your keyring[cite: 3, 4, 5, 6] | daily sign-ins[cite: 3, 4, 5, 6] |
| backup[cite: 3, 4, 5, 6] | stored separately[cite: 3, 4, 5, 6] | recovery only[cite: 3, 4, 5, 6] |
how to undo it
Open each account’s security settings and remove the key. Before you do, confirm that another sign-in method still works, or you may lock yourself out.[cite: 3, 4, 5, 6]
related: all guides[cite: 3, 4, 5, 6]