4 ms·
Is it a bad idea to store ssh keys in a password manager like Bitwarden? If yes, what other easily portable options are out there?
by yewenjie 5y ago
Is it a bad idea to store ssh keys in a password manager like Bitwarden? If yes, what other easily portable options are out there?
- tw04 5y agoYubikey would probably be a better alternative.
- vineyardmike 5y agoAny idea how to set my YubiKey up to handle this?
- smorgusofborg 5y agoIf all the servers you talk to are up to date enough to accept SK keys, I would use one: https://www.yubico.com/blog/github-now-supports-ssh-security-keys/ https://www.yubico.com/blog/github-now-supports-ssh-security...
- oddlama 5y agoI can recommend this guide [1] to setup your yubikey with gpg, which allows you to both use it to sign or encrypt with gpg and also to use it as an ssh key. [1] https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide
- PeterWhittaker 5y agoThe readme specifically mentions Yubikey support. Given the restrictions with Secure Enclave (no import, export, or backup), a smart card or Yubikey probably would be better.
- dividuum 5y agoBetter than having then unencrypted (unless you set a passphrase) on the filesystem for every rogue process to grab. The issue with password managers is the key is then most likely still accessible from other processes while the password manager is unlocked. On linux for example by poking around in /dev/mem or /dev/kmem. There are way that help with that like memfd_secret. A secure enclave or similar side processor avoids this issue by running within its own isolated memory and this processor also handles all key operations, so the key never enters the main memory.