4 ms·
You can encrypt SSH keys with passwords too.
by jhugg 9y ago
You can encrypt SSH keys with passwords too.
- hdhzy 9y agoYes, but passwords can be keylogged and SSH keys on a hardware token (like yubikey) can't. Also if you've got touch-to-use enabled on the token you can't even use the key without physically touching the token.
- agrinman 9y agoAny user-level process can actually obtain your decrypted private-key: https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9f24c1f983d5#1269 https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9...
- clarry 9y agoAddKeysToAgent defaults to no. Ptrace might also be disabled, depending on system. I would be more concerned about keyloggers, or any tricks that result in me running something else than the real ssh client (e.g. custom program somewhere in PATH).