3 ms·
Why do I want my private key on my phone instead of the computer where I am using it?
by eof 9y ago
Why do I want my private key on my phone instead of the computer where I am using it?
- falcolas 9y agoEven if your computer is 100% compromised, SSH can't be used without your explicit permission and knowledge.
- daveloyall 9y agoI think you're saying that if you use this app, and remove other ssh keys from your computer, then "SSH can't be used without your explicit permission and knowledge.". I agree with another commentator, I trust my PC more than I trust my phone. The latter is probably already compromised.
- noja 9y agoI'd like to know this too. My computer is patched daily, my phone less often.
- tptacek 9y agoRespectfully, this is easy: get a better phone and turn autoupdate on.
- h4waii 9y agoAlso respectfully, he stated patched daily. Generally, security updates for both iOS and Android devices happen in a monthly roll-up. If your checklist for being "secure" involves being up-to-date, there is no amount of 'getting a better phone' that will put it on par with a desktop OS that receives daily patches.
- tptacek 9y agoThis is simply not true. No matter how often you patch your Linux desktop, it is less secure than an iPhone.
- h4waii 9y agoConflating secure with up-to-date is wrong in such a broad and sweeping statement such as 'your Linux desktop is always less secure than an iPhone'. Updates software does not instantly mean more secure, which I am sure you are aware of. As you stated, for the generalists, yes, an out-of-the-box iPhone has more hardening than an OOTB Linux desktop, but for the type of person on HN, this is not necessarily true at all. There are too many variables.
- tptacek 9y agoI disagree, but that's fine.
- 4kevinking 9y agoAny user-level application on your computer can read the SSH key -- you'll never know if it's used or sent off somewhere. Even passphrase encrypted keys are vulnerable. Check out this blog post for a deep dive on our threatmodel and why you should store your SSH key on your phone https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9f24c1f983d5 https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9...
- joshribakoff 9y agoI guess its like 2 factor authentication - I can let a friend use my computer & not worry about them SSHing in to my server. Or I could just create a 2nd account on the computer instead of using Kryptonite (easier in my opinion). I also have to wonder what kinds of backdoor access the NSA has to my phone.