Recommendations regarding security keys? (PGP, signed commits, ssh, etc.)

[erikschul]

Hello,

I assume that WebAuthn is unsuitable for PGP, signed commits, ssh, etc.

But what are the alternatives? Connecting with SSH to the container with agent forwarding?

[msujew]

Hey @erikschul,

I would assume you're developing a browser based IDE solution based on Theia? This is actually quite non-trivial. I'm not sure too many people have attempted to solve this. One provider of online workspaces has tried to set something up via 1Password and SSH, see Gitpod's blog post on that topic.

[erikschul]

Thanks Mark, just what I was looking for :)

I've been wanting to build something for a long time that's: local, container-based, and browser based.
Browsers have terrible UX, but at least strict isolation is a primary feature.

I started thinking down that same route, of implementing an ssh agent, but Password1's SSH passthrough is clever (yet peculiar and vendor-specific).

The dream would be that it just worked with WebAuthn, ideally with a dialog that confirms what you're actually signing, but maybe in 10 years :)