3 ms·

Yeah you are basically right. I hate passwords with a passion so I guess it is foolish to even complain about passwords in the aggregate but I mean mentally it

Yeah you are basically right. I hate passwords with a passion so I guess it is foolish to even complain about passwords in the aggregate but I mean mentally it just adds a layer where I have to vaguely remember if I used passwords or another alternative form of authentication with a specific service. I do a lot of data ingestion work, I run my own servers within a ZeroTier setup that links a bunch of machines together. I can only access it from my machines that have a set SSH key setup, so I agree, that's a great system. I ingest data from a bunch of data providers as well as some exchanges/brokers. But for example, look at the disparity for some of these web operators - Gemini only uses Authy for 2FA management iirc + password, Coinbase is Authenticator (or whatever you want) + password, Interactive Brokers has some weird bespoke setup that requires an initial mobile login and then another layer of auth that I can't fully describe. DigitalOcean is authenticator + password, GitHub is authenticator or SMS + password [I'm referring to actually accessing the website from a client device for all of these] Then they all have API key generation which has variable definitions. AWS is nice for its consistency with its AWS access key + private key combo that you can generate whenever you need with IAM profiles. It's just... this is a lot to even need to know. I wish I didn't have to know the intricacies of all these crazy systems. I want to get some stuff done. I'd be down to have it be biometric or something. I'm tired of having to think about how I log into stuff and managing keys for all this shit. Literally - that's my complaint. It's all too much to keep in my head and I'm frequently frustrated by needing to recall this stuff. Sure, lastpass is fine for what it is and I also do try to keep my SSH keys safely stored for re-use where desired or generate machine specific configurations when that is reasonable for the project specification, but it's really just a headache for me. I'd love a ssh key management solution that doesn't drive me bonkers - if you have any suggestions I'll owe you a coffee next time youre in town lol.

iotku 5y ago
>I'd love a ssh key management solution that doesn't drive me bonkers Kinda in the same boat here, taken a glance at Vault [1] but it seems like something that I'd probably spend more time figuring out than get benefit from it given my relatively small footprint. Definitely have a lot more ssh authorized_hosts entries lingering around from old systems than I'm happy about. [1] https://www.vaultproject.io/ https://www.vaultproject.io/
- arthurcolle 5y ago
  Yeah, hashicorp makes good shit but I mean this is a pretty sensitive area - not sure I'd take a stab at using it for anything yet. Shout HN: Does anyone here that might be watching this space have any experience using Vault...?
  - thinkmassive 5y ago
    Many people have experience using Vault, it was first released in 2015 https://github.com/hashicorp/vault/blob/master/CHANGELOG.md https://github.com/hashicorp/vault/blob/master/CHANGELOG.md
  - mewse 5y ago
    A couple years back I installed Vault nodes on three Linode servers. Now, Vault's documentation specifies very clearly that the servers in your Vault deployment need to be talking to each other across a private network and their ports absolutely mustn't be accessible to the public internet. At that time (this may have changed in the interim; I'm not using Linode nearly as much these days), Linode didn't offer private LANs between groups of servers. They did offer private IP addresses, but they had only a single LAN that was shared by every machine in each data center. But I figured; hey, that'd probably be good enough -- Those private IPs weren't publicly accessible, after all! Anyhow, long story short, less than twelve hours later all three machines were furiously mining bitcoin. Lesson learned: when software says that you need a private network, you need a private network.
    - iotku 5y ago
      >Linode didn't offer private LANs between groups of servers. They did offer private IP addresses, but they had only a single LAN that was shared by every machine in each data center. >Lesson learned: when software says that you need a private network, you need a private network. Hah yeah, I imagine a properly secured (famous last words) VPN setup is kinda necessary when dealing with stuff like that. Having your secrets in one place (especially remotely accessible) is a very attractive target and you don't want to find out there's a 0day (or general misconfiguration) on your management system the hard way. I'd like to think that I could make something like that work, but it's certainly more than setup and forget about it.

iotku 5y ago

>I'd love a ssh key management solution that doesn't drive me bonkers Kinda in the same boat here, taken a glance at Vault [1] but it seems like something that I'd probably spend more time figuring out than get benefit from it given my relatively small footprint. Definitely have a lot more ssh authorized_hosts entries lingering around from old systems than I'm happy about. [1] https://www.vaultproject.io/ https://www.vaultproject.io/

arthurcolle 5y ago
Yeah, hashicorp makes good shit but I mean this is a pretty sensitive area - not sure I'd take a stab at using it for anything yet. Shout HN: Does anyone here that might be watching this space have any experience using Vault...?
- thinkmassive 5y ago
  Many people have experience using Vault, it was first released in 2015 https://github.com/hashicorp/vault/blob/master/CHANGELOG.md https://github.com/hashicorp/vault/blob/master/CHANGELOG.md
- mewse 5y ago
  A couple years back I installed Vault nodes on three Linode servers. Now, Vault's documentation specifies very clearly that the servers in your Vault deployment need to be talking to each other across a private network and their ports absolutely mustn't be accessible to the public internet. At that time (this may have changed in the interim; I'm not using Linode nearly as much these days), Linode didn't offer private LANs between groups of servers. They did offer private IP addresses, but they had only a single LAN that was shared by every machine in each data center. But I figured; hey, that'd probably be good enough -- Those private IPs weren't publicly accessible, after all! Anyhow, long story short, less than twelve hours later all three machines were furiously mining bitcoin. Lesson learned: when software says that you need a private network, you need a private network.
  - iotku 5y ago
    >Linode didn't offer private LANs between groups of servers. They did offer private IP addresses, but they had only a single LAN that was shared by every machine in each data center. >Lesson learned: when software says that you need a private network, you need a private network. Hah yeah, I imagine a properly secured (famous last words) VPN setup is kinda necessary when dealing with stuff like that. Having your secrets in one place (especially remotely accessible) is a very attractive target and you don't want to find out there's a 0day (or general misconfiguration) on your management system the hard way. I'd like to think that I could make something like that work, but it's certainly more than setup and forget about it.