5 ms·

You are aware it's usually recommended to have passphrases for keys, yes? Plus, you really should have whole-disk encryption for laptops. (I get the feeling I'

You are aware it's usually recommended to have passphrases for keys, yes? Plus, you really should have whole-disk encryption for laptops. (I get the feeling I'm missing something here, but...)

userbinator 10y ago
Regardless of whether the keyfile has a passphrase, the point is that it exists. And FDE also suggests you may be hiding something. Sometimes the best way to make something secure, is to make it look like there is actually nothing to secure.
- tzs 10y ago
  > And FDE also suggests you may be hiding something. No one needs to bother trying to infer from FDE that I'm hiding something. I will tell them I am if they ask. Financial records, intimate correspondence, and employer trade secrets (I'm authorized to work at home on my personal computer) immediately come to mind and there is probably more. I'm sure I'm not unusual in this regard. Most people have things they are hiding.
- lomnakkus 10y ago
  If anyone's targeting your specific laptop for theft they already think that you're hiding something. If some rando steals your laptop they probably have no clue what SSH even stands for.
- vacri 10y ago
  Security-by-obscurity only works alongside other layers. Do you also do things like stop all system logging? Or shell logging? Even with only user-level access, a simple 'history' will show where you're ssh'ing to, regardless of whether you use a keyfile or not.
- galdosdi 10y ago
  Not these days. FDE is so common and easy to use now, it might well have been an option you blindly hit upon install. And that's just in consumer environments. In corporate environments, in any company with a half-decent infosec department, all employees' computers will simply be required to have FDE, regardless of what they do on the computers.
  - userbinator 10y ago
    FDE is also apparently not entirely impossible to bypass, which leaves you in the same situation of an attacker knowing that those SSH keyfiles exist on your machine. You may think it's all over at that point, but there's different levels of secrecy, and it'd be better that the attacker cannot even know that a further level exists beyond.
    - galdosdi 10y ago
      > FDE is also apparently not entirely impossible to bypass Sounds vague, can you please elaborate or cite? (I am not aware of this and if properly set up, I doubt this is true, so I am excited to learn what you know about this)
makomk 10y ago
Passphrases on SSH keys used to be really easy to brute-force by default and I think they still are. Until two or three years ago the only way to slow down brute-forcing attacks was to use a complicated incantation with openssl to convert the keys to use a slower key derivation. Few people did.
- lomnakkus 10y ago
  Well, except I'm using "Correct Horse...". Oh. Well, I'm actually using a similar scheme to that, but I don't want to give too much away :). Actually, I think you're probably right about the ease of brute-forcing passphrases in practice. That's not to say some random person is going to get access to your SSH key[1], but if you're actually being targeted as a "person of interest" by a nation-state you're probably SoL unless you're actually practicing due diligence... but then I think that's generally the name of the game, no? I mean OPSEC is still a thing even if you're only doing stuff that's shady-but-definitely-not-illegal. [1] This isn't quite a "thing" yet, so some random burglar who steals your laptop isn't going to be attempting brute force.
galdosdi 10y ago
Yes, what you're missing is that userbinator is probably trolling us

You are aware it's usually recommended to have passphrases for keys, yes? Plus, you really should have whole-disk encryption for laptops. (I get the feeling I'm missing something here, but...)

userbinator 10y ago

Regardless of whether the keyfile has a passphrase, the point is that it exists. And FDE also suggests you may be hiding something. Sometimes the best way to make something secure, is to make it look like there is actually nothing to secure.

tzs 10y ago
> And FDE also suggests you may be hiding something. No one needs to bother trying to infer from FDE that I'm hiding something. I will tell them I am if they ask. Financial records, intimate correspondence, and employer trade secrets (I'm authorized to work at home on my personal computer) immediately come to mind and there is probably more. I'm sure I'm not unusual in this regard. Most people have things they are hiding.
lomnakkus 10y ago
If anyone's targeting your specific laptop for theft they already think that you're hiding something. If some rando steals your laptop they probably have no clue what SSH even stands for.
vacri 10y ago
Security-by-obscurity only works alongside other layers. Do you also do things like stop all system logging? Or shell logging? Even with only user-level access, a simple 'history' will show where you're ssh'ing to, regardless of whether you use a keyfile or not.
galdosdi 10y ago
Not these days. FDE is so common and easy to use now, it might well have been an option you blindly hit upon install. And that's just in consumer environments. In corporate environments, in any company with a half-decent infosec department, all employees' computers will simply be required to have FDE, regardless of what they do on the computers.
- userbinator 10y ago
  FDE is also apparently not entirely impossible to bypass, which leaves you in the same situation of an attacker knowing that those SSH keyfiles exist on your machine. You may think it's all over at that point, but there's different levels of secrecy, and it'd be better that the attacker cannot even know that a further level exists beyond.
  - galdosdi 10y ago
    > FDE is also apparently not entirely impossible to bypass Sounds vague, can you please elaborate or cite? (I am not aware of this and if properly set up, I doubt this is true, so I am excited to learn what you know about this)

makomk 10y ago

Passphrases on SSH keys used to be really easy to brute-force by default and I think they still are. Until two or three years ago the only way to slow down brute-forcing attacks was to use a complicated incantation with openssl to convert the keys to use a slower key derivation. Few people did.

lomnakkus 10y ago
Well, except I'm using "Correct Horse...". Oh. Well, I'm actually using a similar scheme to that, but I don't want to give too much away :). Actually, I think you're probably right about the ease of brute-forcing passphrases in practice. That's not to say some random person is going to get access to your SSH key[1], but if you're actually being targeted as a "person of interest" by a nation-state you're probably SoL unless you're actually practicing due diligence... but then I think that's generally the name of the game, no? I mean OPSEC is still a thing even if you're only doing stuff that's shady-but-definitely-not-illegal. [1] This isn't quite a "thing" yet, so some random burglar who steals your laptop isn't going to be attempting brute force.

galdosdi 10y ago

Yes, what you're missing is that userbinator is probably trolling us