5 ms·

One way to protect against this is to not have SSH keys on your laptop. I've been using Kryptonite https://krypt.co/ https://krypt.co/ lately, which is sort of

One way to protect against this is to not have SSH keys on your laptop. I've been using Kryptonite https://krypt.co/ https://krypt.co/ lately, which is sort of like two-factor for SSH keys.

jhugg 9y ago
You can encrypt SSH keys with passwords too.
- hdhzy 9y ago
  Yes, but passwords can be keylogged and SSH keys on a hardware token (like yubikey) can't. Also if you've got touch-to-use enabled on the token you can't even use the key without physically touching the token.
- agrinman 9y ago
  Any user-level process can actually obtain your decrypted private-key: https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9f24c1f983d5#1269 https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9...
  - clarry 9y ago
    AddKeysToAgent defaults to no. Ptrace might also be disabled, depending on system. I would be more concerned about keyloggers, or any tricks that result in me running something else than the real ssh client (e.g. custom program somewhere in PATH).
mintplant 9y ago
This relies on the security of my phone OS, which I trust much less than my desktop's.
- hdhzy 9y ago
  I wonder why is that? Apps on the phone are by default sandboxed and there is no way to get root (instead of running the exploit).
  - mintplant 9y ago
    Lack of updates from OEMs, and a general lack of attention to security on the part of the same, at least on Android. Many devices still haven't received the patch for last month's Broadcom vulnerability, for example.
- libeclipse 9y ago
  I have a Nexus 6P, and I'd trust the security on it a million times more than on my Arch-Linux desktop.
- danielrhodes 9y ago
  If you store things in the secure enclave of the device on iOS, it is likely much more secure.
gruez 9y ago
That doesn't fix the problem either. The attacker could instead wait until a legitimate request piggy back off that and you'll be none the wiser.
dkuntz2 9y ago
That doesn't seem especially more secure. You're just trading away trusting yourself to another company. You can get a similar ssh 2fa setup with Google Authenticator's PAM module (https://github.com/google/google-authenticator-libpam https://github.com/google/google-authenticator-libpam), and maintain full control over your infrastructure.
- pfg 9y ago
  Kryptonite is more like a GPG smartcard (or YubiKey) of sorts (with some security trade-offs for the arguably better UX). The key never leaves your mobile device. Backdoors and bugs are still a possibility of course (when aren't they?), and you probably wouldn't wan to run this on an outdated mobile device. Of course, all you're doing with any of this is preventing your key from leaking. A sufficiently motivated attacker could just backdoor your ssh/git binary and access things through that instead, but it's still a good defense-in-depth mechanism, IMO.
  - danjoc 9y ago
    >Kryptonite is more like a GPG smartcard (or YubiKey) Can it do full disk encryption? Works with GPG agent? PIV? PKCS11? OTP? U2F? >arguably better UX Requires battery. Not waterproof. Not crushproof. >The key never leaves your mobile device. Can't backup the key? I need to buy two iPhones to have a backup in case one is lost?
    - mynameisvlad 9y ago
      The parent comment literally said arguably, as in, can be argued and is based on personal choice. And, although I'm not the commenter, it doesn't read anywhere near it trying to imply Kryptonite is a replacement for Yubikey. They were replying to someone comparing it to the 2FA PAM module, and explaining it's more like a smartcard or Yubikey in that it stores the key, rather than add a second verification outside the key.
      - danjoc 9y ago

One way to protect against this is to not have SSH keys on your laptop. I've been using Kryptonite https://krypt.co/ https://krypt.co/ lately, which is sort of like two-factor for SSH keys.

jhugg 9y ago

You can encrypt SSH keys with passwords too.

hdhzy 9y ago
Yes, but passwords can be keylogged and SSH keys on a hardware token (like yubikey) can't. Also if you've got touch-to-use enabled on the token you can't even use the key without physically touching the token.
agrinman 9y ago
Any user-level process can actually obtain your decrypted private-key: https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9f24c1f983d5#1269 https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9...
- clarry 9y ago
  AddKeysToAgent defaults to no. Ptrace might also be disabled, depending on system. I would be more concerned about keyloggers, or any tricks that result in me running something else than the real ssh client (e.g. custom program somewhere in PATH).

mintplant 9y ago

This relies on the security of my phone OS, which I trust much less than my desktop's.

hdhzy 9y ago
I wonder why is that? Apps on the phone are by default sandboxed and there is no way to get root (instead of running the exploit).
- mintplant 9y ago
  Lack of updates from OEMs, and a general lack of attention to security on the part of the same, at least on Android. Many devices still haven't received the patch for last month's Broadcom vulnerability, for example.
libeclipse 9y ago
I have a Nexus 6P, and I'd trust the security on it a million times more than on my Arch-Linux desktop.
danielrhodes 9y ago
If you store things in the secure enclave of the device on iOS, it is likely much more secure.

gruez 9y ago

That doesn't fix the problem either. The attacker could instead wait until a legitimate request piggy back off that and you'll be none the wiser.

dkuntz2 9y ago

That doesn't seem especially more secure. You're just trading away trusting yourself to another company. You can get a similar ssh 2fa setup with Google Authenticator's PAM module (https://github.com/google/google-authenticator-libpam https://github.com/google/google-authenticator-libpam), and maintain full control over your infrastructure.

pfg 9y ago
Kryptonite is more like a GPG smartcard (or YubiKey) of sorts (with some security trade-offs for the arguably better UX). The key never leaves your mobile device. Backdoors and bugs are still a possibility of course (when aren't they?), and you probably wouldn't wan to run this on an outdated mobile device. Of course, all you're doing with any of this is preventing your key from leaking. A sufficiently motivated attacker could just backdoor your ssh/git binary and access things through that instead, but it's still a good defense-in-depth mechanism, IMO.
- danjoc 9y ago
  >Kryptonite is more like a GPG smartcard (or YubiKey) Can it do full disk encryption? Works with GPG agent? PIV? PKCS11? OTP? U2F? >arguably better UX Requires battery. Not waterproof. Not crushproof. >The key never leaves your mobile device. Can't backup the key? I need to buy two iPhones to have a backup in case one is lost?
  - mynameisvlad 9y ago
    The parent comment literally said arguably, as in, can be argued and is based on personal choice. And, although I'm not the commenter, it doesn't read anywhere near it trying to imply Kryptonite is a replacement for Yubikey. They were replying to someone comparing it to the 2FA PAM module, and explaining it's more like a smartcard or Yubikey in that it stores the key, rather than add a second verification outside the key.
    - danjoc 9y ago