4 ms·
> How much less secure is it to not use a passphrase on a key? It's better to think about specific attack scenarios. If your keys get exfiltrated because of so
by zimbatm 10y ago
> How much less secure is it to not use a passphrase on a key?
It's better to think about specific attack scenarios. If your keys get exfiltrated because of some local exploit (like a browser vulnerability, a malware download or physical access) then the attacker has access to your servers.
- nothrabannosir 10y agothe same holds for keys with passphrases; the attacking process just has to wait until you enter it.
- berdario 10y agoAs I mentioned in my other comment: stealing local files does not necessarily have to happen via unrestricted-RCE (which would allow you access to the ssh agent)
- Godel_unicode 10y agoThis, for instance. http://m.theregister.co.uk/2013/01/25/github_ssh_key_snafu/ http://m.theregister.co.uk/2013/01/25/github_ssh_key_snafu/