5 ms·

Only if you enable iCloud Keychain, which is locally encrypted and synced in encrypted form. https://support.apple.com/en-us/HT202303 https://support.apple.com/

Only if you enable iCloud Keychain, which is locally encrypted and synced in encrypted form. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 has links to the details. It's not useful though as you shouldn't share ssh keys between machines anyway.

AlexeyBrin 10y ago
> you shouldn't share ssh keys between machines anyway. Are you talking about public or private keys ? I see nothing wrong in using same public key to log in from a particular machine to a number of remote machines.
- randallsquared 10y ago
  They meant only private keys.
- bahjoite 10y ago
  > I see nothing wrong in using same public key to log in from a particular machine to a number of remote machines. There is nothing really wrong with it; it's a good way to reduce the burden of managing secrets. The downside though is when multiple remote machines need to be contacted because a private key was revoked. Then again, a common need for revocation is a compromise of the machine on which the private key(s) is stored, which can often mean a number of private keys need to be revoked. I think the ideal is still to have unique key pairs for each client-server combination.
  - cvwright 10y ago
    It's worth thinking this through one step further IMO. What kind of event would cause a private key to be compromised, so that it needs to be revoked? The most likely cases are that (1) the client machine was compromised, or (2) an un-encrypted backup was lost. In either case, I have a hard time seeing how one private key needs to be revoked but others on the same client machine don't.
    - bahjoite 10y ago
      Agreed - it's what I meant by that third sentence. There are of course reasons to revoke one of a collection of keys, for example natural end-of-life rotation, weak key generation and accidental disclosure.
eridius 10y ago
It's not useful to people who use different private keys on different machines. It is useful to anyone who has a single private key that they use on multiple machines. The latter isn't really a great idea, but I bet a bunch of people do it anyway.
- adrianratnapala 10y ago
  In other words, it is useful to people who are doing it wrong.
  - eridius 10y ago
    Security isn't black and white. Maybe they aren't being as secure as they could be, but they're still more secure than someone who just uses a password. And maybe there's no real security concern at all, because both computers are desktops sitting right next to each other with the same user login credentials, so there's not really any reason why someone would need to cycle the key on one machine but not on the other.

AlexeyBrin 10y ago

> you shouldn't share ssh keys between machines anyway. Are you talking about public or private keys ? I see nothing wrong in using same public key to log in from a particular machine to a number of remote machines.

randallsquared 10y ago
They meant only private keys.
bahjoite 10y ago
> I see nothing wrong in using same public key to log in from a particular machine to a number of remote machines. There is nothing really wrong with it; it's a good way to reduce the burden of managing secrets. The downside though is when multiple remote machines need to be contacted because a private key was revoked. Then again, a common need for revocation is a compromise of the machine on which the private key(s) is stored, which can often mean a number of private keys need to be revoked. I think the ideal is still to have unique key pairs for each client-server combination.
- cvwright 10y ago
  It's worth thinking this through one step further IMO. What kind of event would cause a private key to be compromised, so that it needs to be revoked? The most likely cases are that (1) the client machine was compromised, or (2) an un-encrypted backup was lost. In either case, I have a hard time seeing how one private key needs to be revoked but others on the same client machine don't.
  - bahjoite 10y ago
    Agreed - it's what I meant by that third sentence. There are of course reasons to revoke one of a collection of keys, for example natural end-of-life rotation, weak key generation and accidental disclosure.

eridius 10y ago

It's not useful to people who use different private keys on different machines. It is useful to anyone who has a single private key that they use on multiple machines. The latter isn't really a great idea, but I bet a bunch of people do it anyway.

adrianratnapala 10y ago
In other words, it is useful to people who are doing it wrong.
- eridius 10y ago
  Security isn't black and white. Maybe they aren't being as secure as they could be, but they're still more secure than someone who just uses a password. And maybe there's no real security concern at all, because both computers are desktops sitting right next to each other with the same user login credentials, so there's not really any reason why someone would need to cycle the key on one machine but not on the other.