Yubikey

ykvault: Stop Storing API Tokens as Plaintext

Are you still keeping API tokens in ~/.secrets? Any app you install can read them. ykvault encrypts every secret with a YubiKey challenge-response key — each get/set requires a physical touch, and the encrypted files are useless without your key.

Hardware-backed SSH keys end to end: YubiKey, PIV, software alternatives, and where SSH CAs fit in

A working guide to using a YubiKey for SSH on a real Linux fleet — the four knobs (resident, touch, PIN, agent), a four-mode policy for root and Ansible, software-only alternatives, and where SSH CAs fit in.