4 ms·
Passphrases on SSH keys used to be really easy to brute-force by default and I think they still are. Until two or three years ago the only way to slow down brut
by makomk 10y ago
Passphrases on SSH keys used to be really easy to brute-force by default and I think they still are. Until two or three years ago the only way to slow down brute-forcing attacks was to use a complicated incantation with openssl to convert the keys to use a slower key derivation. Few people did.
- lomnakkus 10y agoWell, except I'm using "Correct Horse...". Oh. Well, I'm actually using a similar scheme to that, but I don't want to give too much away :). Actually, I think you're probably right about the ease of brute-forcing passphrases in practice. That's not to say some random person is going to get access to your SSH key[1], but if you're actually being targeted as a "person of interest" by a nation-state you're probably SoL unless you're actually practicing due diligence... but then I think that's generally the name of the game, no? I mean OPSEC is still a thing even if you're only doing stuff that's shady-but-definitely-not-illegal. [1] This isn't quite a "thing" yet, so some random burglar who steals your laptop isn't going to be attempting brute force.