[Feature Request] Allow use of "no-touch-required" for sk ssh keys

[bdelwood]

Per the ssh-keygen docs, sk type ssh keys have an option to disable touch presence via passing -O no-touch-required. sshd rejects such signatures by default, but this can be changed by adding no-touch-required to the authorized_keys option.

It would be nice for no-touch-required sk keys to be supported, via some interface when adding ssh keys on the webui.

[rnorth]

I was about to post similarly; I'd just like to add: in the announcement blog post there's this explanation:

you might wonder why we require verification (via the security key “tap”) when you can configure your security key to allow operations to proceed as long as the security key is present. While we understand the appeal of removing the need for the taps, we determined our current approach to require presence and intention is the best balance between usability and security.

I'd be keen to request that this be reconsidered - it would be great if no-touch-required keys could be an opt-in feature.

As-is, users roughly have a choice between hardware key always requiring taps, and an in-software (keys on disk + ssh agent). The former being very secure but inconvenient, the latter being not very secure but convenient. I would think there are plenty of people for whom a hardware key is appealing for its ability to limit compromise of private keys, who would be willing to forego the added protection that user presence detection gives.

I'd argue that lack of a middle ground option is going to pressure people towards the least secure option, so think that it would be really nice if GitHub could reconsider this approach.

[beachrunner2k]

Perhaps an option to enable "no-touch-required" on GitHub's end on a per key basis inside inside your profile settings would be a desired approach?

[stinovlas]

I totally agree with this. no-touch-required is a must have feature. It doesn't make operations any less secure than having keys on the disk and added to ssh-agent. Tapping the security key with each fetch and push is really annoying.

[lordmortis]

mmm. It's also annoying in that the older PGP-based SSH keys work fine without presence (but you can't use the newer EC-based keys on those) - even to the point of working in clients like Fork. I can't get the newer FIDO based keys with presence working in Fork - yes this is a fork problem, but if I could use my no-touch-required key, this problem would go away...

[mrusme]

GitHub could just allow prefixing the pubkey with no-touch-required , but unfortunately their web interface as well as their API (via gh) prohibit doing so:

HTTP 422: Validation Failed (https://api.github.com/user/keys)
key is invalid. You must supply a key in OpenSSH public key format

It is sad that there's no answer to this after over two years.