Using the device

The whole operating model in one paragraph: a board with a PIN set asks for the PIN and a touch on every operation, and nothing in a WebAuthn request can switch either off. That is deliberate — a board that leaves your pocket opens nothing by itself. (On a stock Pico 2, the touch is the BOOTSEL button — the same button that flashes the board.) Everything below is the daily consequence of that one decision.

The default PINs

Two applets ship with factory PINs:

The OpenPGP card tracks whether its factory values are gone, and while they are in force it refuses to generate, sign or decrypt — so if gpg --card-edit generate errors out on a fresh card, the default PIN is the reason, not a fault. Change both PINs first, then generate. The OATH access code carries the same posture: until you change it, anyone holding the board who tries 123456 gets in. A documented default is the OpenPGP card's way; your changed PIN is the actual defence.

Set the PIN first

Before anything else: ykman fido access change-pin, or accept the PIN prompt the first time a browser enrols the board. The PIN guards every applet's token — makeCredential, getAssertion, credential management, configuration — and derives the permission rules those tokens carry.

Passkeys

Enroll on any WebAuthn site — webauthn.io is the usual first test. The site asks for a touch, the LED confirms, and the credential is generated on the board and stays there. There is room for 848 of them. Sites that offer "sync with your phone" are offering a cloud copy; this board is the non-synced answer.

Managing credentials

Resident keys can be enumerated, renamed and deleted from ykman's fido cred commands or PicoForge's credential manager. Resident SSH keys re-download to any machine with ssh-keygen -K — the key-handle file that lands on disk is a pointer, not a secret. Losing the board means re-enrolling the passkeys — they are non-exportable by design. The one thing that can leave the board is the vendor seed behind the soft lock: the seed backup.

TOTP and HOTP

Add accounts in Yubico Authenticator or ykman oath accounts — after changing the OATH access code, which ships as 123456. The codes are computed on the board when you ask, touch-gated on a PIN-set board — the phone or the laptop holds none of them, which is the point of moving 2FA off an online machine.

Two boundaries worth knowing: the access code is a real lock — until the correct one is presented, LIST and every calculation answer "locked", and it is what survives a power cycle (hardware-verified). The OATH PIN, by contrast, is session state: it does not survive a reboot, so a ykman PIN prompt can reappear after replugging. The access code is the one that guards the applet at rest.

The OpenPGP card

gpg --card-status to meet the card, gpg --card-edit then generate to create the three key slots (sign, encrypt, authenticate) on the chip — the keys are born there and never leave. gpg --change-pin changes the card's PINs — before generate, because the card refuses key operations while its factory PINs are still in force. Encrypt directly to the recipient's key and the message is unreadable to everyone but the holder — no screenshot of a "secure" note, no trusting the channel. Full walks: git commit signing and encrypted mail and files.

On a phone, the same card talks to PGPony and OpenKeychain over a USB OTG cable — PGPony needs its public key paired before it offers the device as a signer.

OTP slots

ykman otp programs the YubiKey-protocol slots, including challenge-response with a touch-gated challenge. Same board, same rule: the secret never leaves.

The LED

Slot and status behavior is configurable from PicoForge. The LED is the only output the board has — worth making it say what you expect.

Factory reset

ykman fido reset wipes the FIDO credentials and the FIDO PIN, and nothing else: the OATH, OTP, OpenPGP and Nostr applets keep their records. (The management applet's full RESET is the stronger act — it wipes Nostr too.) After a reset, the OpenPGP card's serial changes and your host's keyring stubs will point at a card that no longer exists — delete the stale stubs (see what it works with).

Nostr identities

The board holds up to eight BIP-340 Nostr identities and signs with them through the fapico2 Nostr extension — the browser asks, you approve in a small window, and the physical touch signs. The private keys live in the same sealed store as everything else and never leave the board — custody is import-only — and an optional board PIN can put the whole set behind a verify that dies with the power cycle. The full walk: Nostr identities.

No board yet?

The same applet code runs on the host with --features emulation over TCP sockets — it is how every test in ./run_tests.sh exercises FIDO2, OpenPGP and OATH without hardware. It is a test harness, not a polished window, but it answers "does this thing behave as advertised" before any money is spent.