5 ms·

> Likewise, my ssh keys are also not password protected. If you are able to read my ssh keys, you have already won anyways. No point to me in having a password

> Likewise, my ssh keys are also not password protected. If you are able to read my ssh keys, you have already won anyways. No point to me in having a password on them. None of this is ever so black and white. If I have your ssh keys, haven't I only won if you're not also using a password? Otherwise, all I have is your ssh keys, which granted, is bad, but defense-in-depth, no?

AnthonyMouse 5y ago
> If I have your ssh keys, haven't I only won if you're not also using a password? In general if someone has enough access to get your ssh private keys, they have enough access to log the next time you type the password. > Otherwise, all I have is your ssh keys, which granted, is bad, but defense-in-depth, no? Everything is trade offs. In order for the password to not be completely worthless, it has to be complex enough to not be trivially broken by password crackers. But then it's long and hard to type. If you have to type it a lot, and all it's buying you is that the attacker has to wait for the next time you type the password, that's a poor cost benefit ratio.
- montroser 5y ago
  If someone has my private keys because they stole my laptop, then a keylogger will do them no good, and the password will be a valuable layer of defense.
  - vbezhenar 5y ago
    It is a good idea to use disk encryption anyway.
    - montroser 5y ago
      Yes, that too! Disk encryption, aggressive lock screen timeouts, etc -- that's all good stuff in addition. But the point is that defense-in-depth works, and passwords can be a meaningful part of the strategy.
- irishsultan 5y ago
  > In general if someone has enough access to get your ssh private keys, they have enough access to log the next time you type the password. Isn't this only true assuming the private key isn't backed up somewhere?
  - AnthonyMouse 5y ago
    You mean assuming they don't get your private key from the backups. But then you want to encrypt all the backups and not just the private key, right?

AnthonyMouse 5y ago

> If I have your ssh keys, haven't I only won if you're not also using a password? In general if someone has enough access to get your ssh private keys, they have enough access to log the next time you type the password. > Otherwise, all I have is your ssh keys, which granted, is bad, but defense-in-depth, no? Everything is trade offs. In order for the password to not be completely worthless, it has to be complex enough to not be trivially broken by password crackers. But then it's long and hard to type. If you have to type it a lot, and all it's buying you is that the attacker has to wait for the next time you type the password, that's a poor cost benefit ratio.

montroser 5y ago
If someone has my private keys because they stole my laptop, then a keylogger will do them no good, and the password will be a valuable layer of defense.
- vbezhenar 5y ago
  It is a good idea to use disk encryption anyway.
  - montroser 5y ago
    Yes, that too! Disk encryption, aggressive lock screen timeouts, etc -- that's all good stuff in addition. But the point is that defense-in-depth works, and passwords can be a meaningful part of the strategy.
irishsultan 5y ago
> In general if someone has enough access to get your ssh private keys, they have enough access to log the next time you type the password. Isn't this only true assuming the private key isn't backed up somewhere?
- AnthonyMouse 5y ago
  You mean assuming they don't get your private key from the backups. But then you want to encrypt all the backups and not just the private key, right?