5 ms·

This would mean I'd have to either remember to carry around a flash drive to access my server from the computers at the college library, or keep a copy of my pr

This would mean I'd have to either remember to carry around a flash drive to access my server from the computers at the college library, or keep a copy of my private key on my networking drive there, a network I don't have any reason to believe is perfectly secure.

eterm 10y ago
In either case generate different private keys to use there, so you can revoke the ones used from those computers easily without revoking your more tightly controlled keys. Private keys are like passwords, try not to re-use them.
no_protocol 10y ago
Protect it with a strong passphrase.
- zatkin 10y ago
  https://www.xkcd.com/936/ https://www.xkcd.com/936/ I recommend reading this XKCD comic for how to come up with strong passphrases.
  - whatsdoom 10y ago
    https://pypi.python.org/pypi/xkcdpass/1.8.2 https://pypi.python.org/pypi/xkcdpass/1.8.2 Nice implementation of xkcd passwords.
    - eatbitseveryday 10y ago
      Or.. you can use the web with this one! https://xkpasswd.net/ https://xkpasswd.net/
      - ibotty 10y ago
        Bright idea! Using someone elses Computer To generate your password!
        eatbitseveryday 10y ago
        It's easier to use for the lay person than a from-source-compilation you execute as a command line binary.
        wtbob 10y ago
        Yes, it's easier, but it's completely and totally insecure. Security is not terribly hard, but it is completely and totally unforgiving. If you slip up on security, you will suffer, or others will suffer because of you. Don't slip up on security.
  - KMag 10y ago
    I recently put up on github the latest incarnation of a password generator I've been using for over a decade now.[1] It uses gpg to encrypt each site's username and a random password (using /dev/urandom or CryptGenRandom as the entropy source) in a separate file ~/Documents/Passwords/<domain>.gpg . At the time I first wrote it, I wanted something that was future-proof and where I could decrypt my passwords anywhere, and where a hardware fault while adding a new password was unlikely to cause corruption of pre-existing passwords. Make your xkcd wordlist (http://google.com/search?q=oxford+3000 http://google.com/search?q=oxford+3000 is a good start), one line per word, and bzip2 compress it as ~/Documents/Passwords/wordlist.txt.bz2 (or My Documents\Passwords\wordlist.txt.bz2 on Windows) and run the password generator with --alphabet 100 (restricting choices of "alphabets" to those with over 99 characters) and you'll get xkcd-style pass phrases. I also put some numbers in my word list, so I get passwords like blood Evil pint Urge occupy short railway 38 Diagram elbow Arrest 80 Ceremony monday salt sector It defaults to making the password/pass phrase length ceil(96 * log(2) / log(len(alphabet))) (96 bits of entropy). If you want to dial that up to 128 bits (or down to 80 bits), put { "bits" : 128 } in ~/Documents/Passwords/config.json (My Documents/Passwords/config.json on windows). [1]https://github.com/kmag/store_password_gpg https://github.com/kmag/store_password_gpg
    - rocqua 10y ago
      Look at diceware for another great system to generate passwords.
      - KMag 10y ago
        Yes, I started out with a script that used the diceware wordlist to generate passwords and manually used gpg to store my passwords, then evolved my script to combine the two steps I was doing manually. Have a look at my script. It's all of 200 lines. Easy to audit, and I'm not doing any of my own crypto or random number generation.
- Dylan16807 10y ago
  And set the encryption to use pkcs8 with a million iterations.
alexk 10y ago
This can be quite inconvenient, that's why there's a way to make it more user friendly by using 2FA authentication or Google based SSO with your SSH: http://gravitational.com/teleport/docs/admin-guide/#openid-oauth2 http://gravitational.com/teleport/docs/admin-guide/#openid-o...
ashitlerferad 10y ago
I wouldn't use untrusted computers to access my servers.
- putlake 10y ago
  This. If you're typing in your password on a library computer, you're very vulnerable.
  - matt_wulfeck 10y ago
    My first server was totally exposed in the DMZ. I ran windows RDP with the password "supersecret" for a long time also. I remember at one point also realizing that I could login to ftp anonymously. It was horrendous security in those early days and I had no idea what the heck I was doing. Don't scare everybody off because it's not a best practice. If his/her server gets pwned they'll fix, learn, and move on. A password is fine for your fun server. It's not super secure. It you're probably not interesting enough to get pwned using it.
    - voltagex_ 10y ago
      The problem is insecure PCs and servers are a net negative for the Internet as a whole. I'm now on a fast enough connection with good enough hardware that if you were able to get into one of my desktops or even just the router I'd be inadvertently sending out a lot of spam or "donating" a lot of bandwidth to a DDoS. Also, scans of the entire IPv4 internet take less than an hour now, so there's absolutely no security-through-obscurity.
    - enraged_camel 10y ago
      This is wrong. Compromised servers often become part of bot nets that cause real damage.
      - duskwuff 10y ago
        Heck, even compromised wireless routers[1] and CCTV systems[2] become part of botnets. Anything that's known to be insecure will be exploited. [1]: http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home-routers/ http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-h... [2]: https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-ddos-attacks.html https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-...
snarfy 10y ago
I keep it on my phone.
andai 10y ago
If you want to be paranoid, I wouldn't type sensitive info into those machines (for any number of reasons)
usaphp 10y ago
You can also store the key file on your phone and copy it to whatever computer you want to login to, carrying a phone is easier then an extra flash drive
KMag 10y ago
1. Don't use untrusted hosts to access trusted hosts. 2. If you do, put Tails on a USB drive and use S/Key one-time passwords to access your hosts. Tails should protect you from most real-time stealing of your passwords, and S/Key should protect you from most hardware keylooggers (by the time the one-time password is exfiltrated, it's useless).
wtbob 10y ago
If you're accessing computers you care about from a computer you don't control, you don't really care about them. It's already game over: sufficiently-advanced software could easily permit you to log in, then execute any sequence of commands leading to the downfall of your servers.

eterm 10y ago

In either case generate different private keys to use there, so you can revoke the ones used from those computers easily without revoking your more tightly controlled keys. Private keys are like passwords, try not to re-use them.

no_protocol 10y ago

Protect it with a strong passphrase.

zatkin 10y ago
https://www.xkcd.com/936/ https://www.xkcd.com/936/ I recommend reading this XKCD comic for how to come up with strong passphrases.
- whatsdoom 10y ago
  https://pypi.python.org/pypi/xkcdpass/1.8.2 https://pypi.python.org/pypi/xkcdpass/1.8.2 Nice implementation of xkcd passwords.
  - eatbitseveryday 10y ago
    Or.. you can use the web with this one! https://xkpasswd.net/ https://xkpasswd.net/
    - ibotty 10y ago
      Bright idea! Using someone elses Computer To generate your password!
      - eatbitseveryday 10y ago
        It's easier to use for the lay person than a from-source-compilation you execute as a command line binary.
        wtbob 10y ago
        Yes, it's easier, but it's completely and totally insecure. Security is not terribly hard, but it is completely and totally unforgiving. If you slip up on security, you will suffer, or others will suffer because of you. Don't slip up on security.
- KMag 10y ago
  I recently put up on github the latest incarnation of a password generator I've been using for over a decade now.[1] It uses gpg to encrypt each site's username and a random password (using /dev/urandom or CryptGenRandom as the entropy source) in a separate file ~/Documents/Passwords/<domain>.gpg . At the time I first wrote it, I wanted something that was future-proof and where I could decrypt my passwords anywhere, and where a hardware fault while adding a new password was unlikely to cause corruption of pre-existing passwords. Make your xkcd wordlist (http://google.com/search?q=oxford+3000 http://google.com/search?q=oxford+3000 is a good start), one line per word, and bzip2 compress it as ~/Documents/Passwords/wordlist.txt.bz2 (or My Documents\Passwords\wordlist.txt.bz2 on Windows) and run the password generator with --alphabet 100 (restricting choices of "alphabets" to those with over 99 characters) and you'll get xkcd-style pass phrases. I also put some numbers in my word list, so I get passwords like blood Evil pint Urge occupy short railway 38 Diagram elbow Arrest 80 Ceremony monday salt sector It defaults to making the password/pass phrase length ceil(96 * log(2) / log(len(alphabet))) (96 bits of entropy). If you want to dial that up to 128 bits (or down to 80 bits), put { "bits" : 128 } in ~/Documents/Passwords/config.json (My Documents/Passwords/config.json on windows). [1]https://github.com/kmag/store_password_gpg https://github.com/kmag/store_password_gpg
  - rocqua 10y ago
    Look at diceware for another great system to generate passwords.
    - KMag 10y ago
      Yes, I started out with a script that used the diceware wordlist to generate passwords and manually used gpg to store my passwords, then evolved my script to combine the two steps I was doing manually. Have a look at my script. It's all of 200 lines. Easy to audit, and I'm not doing any of my own crypto or random number generation.
Dylan16807 10y ago
And set the encryption to use pkcs8 with a million iterations.

alexk 10y ago

This can be quite inconvenient, that's why there's a way to make it more user friendly by using 2FA authentication or Google based SSO with your SSH: http://gravitational.com/teleport/docs/admin-guide/#openid-oauth2 http://gravitational.com/teleport/docs/admin-guide/#openid-o...

ashitlerferad 10y ago

I wouldn't use untrusted computers to access my servers.

putlake 10y ago
This. If you're typing in your password on a library computer, you're very vulnerable.
- matt_wulfeck 10y ago
  My first server was totally exposed in the DMZ. I ran windows RDP with the password "supersecret" for a long time also. I remember at one point also realizing that I could login to ftp anonymously. It was horrendous security in those early days and I had no idea what the heck I was doing. Don't scare everybody off because it's not a best practice. If his/her server gets pwned they'll fix, learn, and move on. A password is fine for your fun server. It's not super secure. It you're probably not interesting enough to get pwned using it.
  - voltagex_ 10y ago
    The problem is insecure PCs and servers are a net negative for the Internet as a whole. I'm now on a fast enough connection with good enough hardware that if you were able to get into one of my desktops or even just the router I'd be inadvertently sending out a lot of spam or "donating" a lot of bandwidth to a DDoS. Also, scans of the entire IPv4 internet take less than an hour now, so there's absolutely no security-through-obscurity.
  - enraged_camel 10y ago
    This is wrong. Compromised servers often become part of bot nets that cause real damage.
    - duskwuff 10y ago
      Heck, even compromised wireless routers[1] and CCTV systems[2] become part of botnets. Anything that's known to be insecure will be exploited. [1]: http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home-routers/ http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-h... [2]: https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-ddos-attacks.html https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-...

snarfy 10y ago

I keep it on my phone.

andai 10y ago

If you want to be paranoid, I wouldn't type sensitive info into those machines (for any number of reasons)

usaphp 10y ago

You can also store the key file on your phone and copy it to whatever computer you want to login to, carrying a phone is easier then an extra flash drive

KMag 10y ago

1. Don't use untrusted hosts to access trusted hosts. 2. If you do, put Tails on a USB drive and use S/Key one-time passwords to access your hosts. Tails should protect you from most real-time stealing of your passwords, and S/Key should protect you from most hardware keylooggers (by the time the one-time password is exfiltrated, it's useless).

wtbob 10y ago

If you're accessing computers you care about from a computer you don't control, you don't really care about them. It's already game over: sufficiently-advanced software could easily permit you to log in, then execute any sequence of commands leading to the downfall of your servers.