3 ms·
The first rule: never share a private keys between physical devices. Apart from reducing the opportunities for it to go walkies in transit, or accidentally get
by regularfry 10y ago
The first rule: never share a private keys between physical devices. Apart from reducing the opportunities for it to go walkies in transit, or accidentally get left on a USB stick, it allows you to revoke a single credential if you lose (control over) that device.
From that, we get:
- you're not sharing passphrases between keys, you're
sharing them between devices, and whether that's safe
depends how likely it is that a compromised passphrase
on one device can be transferred by an attacker to another.
- Similarly, whether a blank passphrase is a good idea or
not depends on what other measures are protecting access
to that private key.
- If a private key ever turns up on the wrong machine,
you *know* the key and both source and destination
machines have been compromised.
- lawpoop 10y agoIf I understand this properly, how do you use the same identity from two different machines on a service like github? If they only allow you to upload one public key per account, then you aren't able to use that account on both your desktop and laptop, if you have separate private keys on them, no? Edit: Actually I just looked at github and they allow multiple keys. Is it generally the case that any service that offers ssh keys will allow multiple keys?
- regularfry 10y agoThere's no reason not to. The `authorized_keys` file on a host does exactly that. Whether a specific service does the same is down to that service.
- lawpoop 10y agoHow do you revoke the keys when a machine a compromised? Log in to each service and remove it when you become aware?