3 ms·
Anyone here not encrypting their private keys? Also known_hosts file is a double edged sword. It's pretty sensitive in combination with a private key.
by megous 7y ago
Anyone here not encrypting their private keys?
Also known_hosts file is a double edged sword. It's pretty sensitive in combination with a private key.
- danieldk 7y agoYou shouldn't just encrypt the keys. If malicious code is running on a machine, they could as well eavesdrop on keystrokes. This is even made simpler by the fact that a large part of the demography uses X11, which is inherently insecure since all applications can read key strokes, mouse events, and do screen grabs. Get a hardware token. If you have a hardware token with a pin, they could extract your PIN by reading keystrokes and use the token on your machine. But once you yank the token out of the USB port, that's the end of it. Even better is a hardware token that requires physical confirmation for operations.
- avian 7y agoModern SSH versions only store hashes of domain names in the known_hosts file exactly for this reason.
- megous 7y agoHmm, you're right, but HashKnownHosts in openssh defaults to no, still.
- ohyeshedid 7y agoI haven't personally seen that enabled by default.
- deleted 7y ago[deleted]