4 ms·

>Was the whole password to SSH key switch annoying at all for anyone else? Never was an issue for me because I'd always been using keys in the first place. I i

by iotku 5y ago

>Was the whole password to SSH key switch annoying at all for anyone else? Never was an issue for me because I'd always been using keys in the first place. I imagine it's less common for folks who don't manage servers, but all of my prior ssh usage had switched to keys over a decade ago. >Like procedurally its simple but I have a bunch of accounts, a bunch of different repos. Definitely recommend looking into creating a ssh config if you're using different keys per account. (Notably you can set your IdentityFile (key to use) per host (which can also be set as something arbitrary like "gh-username") There's a pretty friendly post here: https://nerderati.com/2011/03/17/simplify-your-life-with-an-ssh-config-file/ https://nerderati.com/2011/03/17/simplify-your-life-with-an-... >Let me use a password if I want, these security requirements are becoming increasing absurd I don't want my software dependencies to be compromised just because someone reused a password. >Passwords are 100% the weakest link in our beep boop chain of trust, of course - we know this. But maybe they should just be rethought from the ground up instead of randomly affecting your users all the time with security nonsense. Keys are rethinking it from the ground up (which seems to be the complaint), though there certainly are challenges in managing keys as well.

arthurcolle 5y ago
Yeah you are basically right. I hate passwords with a passion so I guess it is foolish to even complain about passwords in the aggregate but I mean mentally it just adds a layer where I have to vaguely remember if I used passwords or another alternative form of authentication with a specific service. I do a lot of data ingestion work, I run my own servers within a ZeroTier setup that links a bunch of machines together. I can only access it from my machines that have a set SSH key setup, so I agree, that's a great system. I ingest data from a bunch of data providers as well as some exchanges/brokers. But for example, look at the disparity for some of these web operators - Gemini only uses Authy for 2FA management iirc + password, Coinbase is Authenticator (or whatever you want) + password, Interactive Brokers has some weird bespoke setup that requires an initial mobile login and then another layer of auth that I can't fully describe. DigitalOcean is authenticator + password, GitHub is authenticator or SMS + password [I'm referring to actually accessing the website from a client device for all of these] Then they all have API key generation which has variable definitions. AWS is nice for its consistency with its AWS access key + private key combo that you can generate whenever you need with IAM profiles. It's just... this is a lot to even need to know. I wish I didn't have to know the intricacies of all these crazy systems. I want to get some stuff done. I'd be down to have it be biometric or something. I'm tired of having to think about how I log into stuff and managing keys for all this shit. Literally - that's my complaint. It's all too much to keep in my head and I'm frequently frustrated by needing to recall this stuff. Sure, lastpass is fine for what it is and I also do try to keep my SSH keys safely stored for re-use where desired or generate machine specific configurations when that is reasonable for the project specification, but it's really just a headache for me. I'd love a ssh key management solution that doesn't drive me bonkers - if you have any suggestions I'll owe you a coffee next time youre in town lol.
- iotku 5y ago
  >I'd love a ssh key management solution that doesn't drive me bonkers Kinda in the same boat here, taken a glance at Vault [1] but it seems like something that I'd probably spend more time figuring out than get benefit from it given my relatively small footprint. Definitely have a lot more ssh authorized_hosts entries lingering around from old systems than I'm happy about. [1] https://www.vaultproject.io/ https://www.vaultproject.io/
  - arthurcolle 5y ago
    Yeah, hashicorp makes good shit but I mean this is a pretty sensitive area - not sure I'd take a stab at using it for anything yet. Shout HN: Does anyone here that might be watching this space have any experience using Vault...?
    - thinkmassive 5y ago
      Many people have experience using Vault, it was first released in 2015 https://github.com/hashicorp/vault/blob/master/CHANGELOG.md https://github.com/hashicorp/vault/blob/master/CHANGELOG.md
    - mewse 5y ago
      A couple years back I installed Vault nodes on three Linode servers. Now, Vault's documentation specifies very clearly that the servers in your Vault deployment need to be talking to each other across a private network and their ports absolutely mustn't be accessible to the public internet. At that time (this may have changed in the interim; I'm not using Linode nearly as much these days), Linode didn't offer private LANs between groups of servers. They did offer private IP addresses, but they had only a single LAN that was shared by every machine in each data center. But I figured; hey, that'd probably be good enough -- Those private IPs weren't publicly accessible, after all! Anyhow, long story short, less than twelve hours later all three machines were furiously mining bitcoin. Lesson learned: when software says that you need a private network, you need a private network.
      - 5y ago

by iotku 5y ago

arthurcolle 5y ago

Yeah you are basically right. I hate passwords with a passion so I guess it is foolish to even complain about passwords in the aggregate but I mean mentally it just adds a layer where I have to vaguely remember if I used passwords or another alternative form of authentication with a specific service. I do a lot of data ingestion work, I run my own servers within a ZeroTier setup that links a bunch of machines together. I can only access it from my machines that have a set SSH key setup, so I agree, that's a great system. I ingest data from a bunch of data providers as well as some exchanges/brokers. But for example, look at the disparity for some of these web operators - Gemini only uses Authy for 2FA management iirc + password, Coinbase is Authenticator (or whatever you want) + password, Interactive Brokers has some weird bespoke setup that requires an initial mobile login and then another layer of auth that I can't fully describe. DigitalOcean is authenticator + password, GitHub is authenticator or SMS + password [I'm referring to actually accessing the website from a client device for all of these] Then they all have API key generation which has variable definitions. AWS is nice for its consistency with its AWS access key + private key combo that you can generate whenever you need with IAM profiles. It's just... this is a lot to even need to know. I wish I didn't have to know the intricacies of all these crazy systems. I want to get some stuff done. I'd be down to have it be biometric or something. I'm tired of having to think about how I log into stuff and managing keys for all this shit. Literally - that's my complaint. It's all too much to keep in my head and I'm frequently frustrated by needing to recall this stuff. Sure, lastpass is fine for what it is and I also do try to keep my SSH keys safely stored for re-use where desired or generate machine specific configurations when that is reasonable for the project specification, but it's really just a headache for me. I'd love a ssh key management solution that doesn't drive me bonkers - if you have any suggestions I'll owe you a coffee next time youre in town lol.

iotku 5y ago
>I'd love a ssh key management solution that doesn't drive me bonkers Kinda in the same boat here, taken a glance at Vault [1] but it seems like something that I'd probably spend more time figuring out than get benefit from it given my relatively small footprint. Definitely have a lot more ssh authorized_hosts entries lingering around from old systems than I'm happy about. [1] https://www.vaultproject.io/ https://www.vaultproject.io/
- arthurcolle 5y ago
  Yeah, hashicorp makes good shit but I mean this is a pretty sensitive area - not sure I'd take a stab at using it for anything yet. Shout HN: Does anyone here that might be watching this space have any experience using Vault...?
  - thinkmassive 5y ago
    Many people have experience using Vault, it was first released in 2015 https://github.com/hashicorp/vault/blob/master/CHANGELOG.md https://github.com/hashicorp/vault/blob/master/CHANGELOG.md
  - mewse 5y ago
    A couple years back I installed Vault nodes on three Linode servers. Now, Vault's documentation specifies very clearly that the servers in your Vault deployment need to be talking to each other across a private network and their ports absolutely mustn't be accessible to the public internet. At that time (this may have changed in the interim; I'm not using Linode nearly as much these days), Linode didn't offer private LANs between groups of servers. They did offer private IP addresses, but they had only a single LAN that was shared by every machine in each data center. But I figured; hey, that'd probably be good enough -- Those private IPs weren't publicly accessible, after all! Anyhow, long story short, less than twelve hours later all three machines were furiously mining bitcoin. Lesson learned: when software says that you need a private network, you need a private network.
    - 5y ago