3 ms·
- No private keys on developers machines, rendering all types of supply chain attacks like NPM stealing your .ssh files ineffective Would it be able to get the
by dec0dedab0de 5y ago
- No private keys on developers machines, rendering all types of supply chain attacks like NPM stealing your .ssh files ineffective
Would it be able to get the key from the usb device? Or does the hashing happen on the device itself with the private key never exposed? If that's how it works, that would be awesome, but would a malicious program be able to sign something as you, instead of stealing the keys?
I'm going to look into this more and maybe recommend it at work.
- coldacid 5y ago>Would it be able to get the key from the usb device? Or does the hashing happen on the device itself with the private key never exposed? If you could extract the key, you probably have access to the intelligence resources of a very large nation. With hardware security dongles, the key remains on the dongle; you pass your data in and it passes the signature (or encrypted data) back out.