yubikey-github
Enhance Your GitHub Security with YubiKey
This repository contains two comprehensive tutorials designed to significantly improve the security of your GitHub workflow using a YubiKey hardware token. By following these guides, you can protect your account with hardware-backed authentication and ensure the integrity of your commits.
Available Guides
1. SSH Authentication with YubiKey
This guide walks you through setting up your YubiKey to handle SSH authentication for your GitHub account. Instead of using a password or a conventional SSH key file, you will use your YubiKey to physically approve push/pull operations.
- Features: FIDO2/U2F keys, resident keys for portability, and OS-specific SSH agent configuration.
- Outcome: Phishing-resistant, hardware-based authentication for all Git operations.
➡️ View the Full SSH Setup Guide
2. GPG Commit Signing with YubiKey
This guide explains how to configure your YubiKey to sign your Git commits using GPG. This process adds a “Verified” badge to your commits on GitHub, proving they came from you and have not been tampered with.
- Features: On-device key generation, PIN protection, and signature-by-touch policy.
- Outcome: Cryptographically verified commits that enhance the trust and integrity of your repository.