Does anyone have experience with either #Yubikey, #Nitrokey or any other hardware security token for both #MFA/#2FA as well as #encryption via #PGP/#GPG or #SMIME?

In particular, I am looking at the Nitrokey 3A NFC. As far as I can tell, Yubico only sells #MFA tokens(?), unless the YubiKey 5 FIPS Series can hold encryption keys as well?

Both price and open hardware aspect definitely speak for Nitrokey, but I do not know anyone who owns such a token... Anyone who I can talk to?

@jayvii Yubikey 5 series can store, among others, PGP and PIV keys, which you can use for signing and encrypting e-mails.

@forst good to know, thanks! Do you own one yourself? If so, do you use any of those features besides MFA?

@jayvii Yep, I have Yubikey 5C, I use both PGP and PIV.

@jayvii
I have a Yubikey 5 and use it with GPG and SSH.
Maybe @nitrokey can tell You more about its functionality.
@forst

@jayvii asked the same question recently and got mixed responses. Personally im going with yubikey (my first order never made it and got returned i need to reorder)

https://social.treehouse.systems/@cas/114381054193693251

@cas interesting answeres there. Thanks for the thread! What made you choose yubikey in the end?

@jayvii
We've been using Nitrokey Pro for years now, for both pgp and gpg. It's a very old one, and it can only store a limited number of totp tokens. I tend to use it in combination with passwordstore and the otp plugin, using the Nitrokey just for encryption of that data, which makes it mfa imo. Don't know about the newer hardware, but this has been working fine for years. Let me know if you have more questions.

@timstoop I have never owned a hardware token before. So far I have only used software solutions for both MFA and used pgp/gpg directly stored on my devices.

How would you rate the setup experience for the sticks? Can you go over to any trusted device and easily use your keys and MFA directly or is there some involved setup process for each device you want to use this with?

@jayvii
Basically, the old Nitrokey Pro I use (pointing it out specifically as things may have changed in newer hw) only really does pgp/gnupg, but you can easily set up the gpg agent to act as a ssh agent. Once set up (via some commands you run inside a gnupg shell) it basically just works. If you don't have it plugged in, it'll give you a pop-up, otherwise it'll ask for your pin. Setup is basically running a few commands from the docs (https://docs.nitrokey.com/nitrokeys/pro/getting-started). Had no issues with it.