diff --git a/content/tkey_passage_2.md b/content/tkey_passage_2.md
new file mode 100644
index 0000000..d756639
--- /dev/null
+++ b/content/tkey_passage_2.md
@@ -0,0 +1,80 @@
+Title: Tillitis TKey with passage: part 2
+Date: 2023-06-30
+Category: Posts
+Tags: Tutorial, Security, Hardware
+Status: Draft
+
+
+In our [last]({filename}/tkey_passage.md) episode, we used the `age-plugin-tkey` age plugin with the passage tool to encrypt a local password store without gpg.
+
+This time, we'll discuss an easier way to install the plugin (on Arch linux, anyway), and try to use it with the [passff](https://github.com/passff/passff) extension to load passwords into firefox automagically.
+
+
+Installing the plugin with a PKGBUILD
+---
+
+We do still need to manually set up user id mappings for podman. I don't know a way to do this from the PKGBUILD, so I won't be submitting this to the [AUR](https://aur.archlinux.org/). Additional info in the [Wiki](https://wiki.archlinux.org/title/Podman#Rootless_Podman). You should have a mapping for the user that builds the package, along with root.
+
+    :::sh
+    $ cat /etc/subuid
+    root:100000:65536
+    cinnaboot:200000:65536
+
+    $ cat /etc/subgid
+    root:100000:65536
+    cinnaboot:200000:65536
+
+Next, let's clone the [PKGBUILD](https://bxxa.cc/gitea/cinnaboot/age-plugin-tkey-archlinux) repo, and build/install the package.
+
+    :::sh
+    $ git clone https://bxxa.cc/gitea/cinnaboot/age-plugin-tkey-archlinux
+    $ makepkg -si
+
+Now you should have the age-plugin-tkey package installed, and the binary in your $PATH at `/usr/bin/age-plugin-tkey`. Now if you need to remove plugin, you can do so normally with the package manager. Check that it shows up as a `foreign` package.
+
+    :::sh
+    $ pacman -Qm
+    age-plugin-tkey e524299-1
+
+
+Set up the password store
+---
+
+Refer to the [previous]({filename}/tkey_passage.md) article to set up your keys, and install the passage tool. In particular, make sure to have a backup key either password protected, or offline.
+
+
+Install the browser extension
+---
+
+There are Arch [packages](https://archlinux.org/packages/?sort=&q=passff) in extra for the extension, and the native messaging host we need, but I want to edit the configuration, so we'll install the extension from the browser, and the host application manually.
+
+Download the extension in browser: [Link](https://addons.mozilla.org/en-US/firefox/addon/passff/)
+
+**NOTE: should probably update to use the install script, and download via a release**
+
+Clone the native message host [repo](https://github.com/passff/passff-host), and copy the files to the proper locations.
+
+    :::sh
+    $ git clone https://github.com/passff/passff-host
+    $ mkdir ~/.mozilla/native-messaging-hosts/
+    $ cp passff-host/src/passff.* ~/.mozilla/native-messaging-hosts/
+
+Now we need to edit the config file to point to the install location:
+
+    :::sh
+      "path": "~/.mozilla/native-messaging-hosts/passff.py",
+
+And, update the passff.py to use passage:
+
+    :::sh
+    COMMAND = "passage"
+
+Restart firefox, and you should be able to connect to the native app with the plugin UI.
+
+And I've just crashed my whole x session...
+
+Not working out of the box, need to debug further:
+
+- [CONTRIBUTING.md](https://github.com/passff/passff/blob/main/docs/CONTRIBUTING.md)
+- [passff](https://github.com/passff/passff)
+- [passff-host](https://github.com/passff/passff-host)