3 ms·
> This doesn’t actually pose much additional security risk because by hypothesis anyone who can read this file has read access to your current private ssh keys
by michaelmior 11y ago
> This doesn’t actually pose much additional security risk because by hypothesis anyone who can read this file has read access to your current private ssh keys already.
Yes, but they don't have access to my password. That's kind of the point. Having a password-protected private key file is much less useful without the password. If you're going to store the password, might as well just remove it and save yourself the trouble.
- singlow 11y agoI read it like you the first time but now I think he means the remote account password. As if I have password auth enabled in sshd.
- csirac2 11y agoBut he talks about GPG directories. And then says he uses drive encryption... To protect his passwords? No, these sentences don't make sense.
- db48x 11y agoTo protect all the files on his computer(s), including the public/private key pairs that allow him access to remote machines.
- csirac2 11y agoI feel like I'm stating the obvious so perhaps I'm missing something, but FDE only protects anything when a computer is off or a volume is otherwise not mounted. Eg. your average shoulder surfing/xscreensaver unlock bypassing jerk, hacker or piece of malware isn't going to bother checking if an already mounted filesystem happens to be on an encrypted block device and voluntarily decide not to copy all your private keyfiles.