3 ms·
SSH public keys are called public keys because they're totally safe to distribute anywhere. That's rather the entire point of asymmetric cryptography. So I gue
by bityard 4y ago
SSH public keys are called public keys because they're totally safe to distribute anywhere. That's rather the entire point of asymmetric cryptography.
So I guess I don't really understand the problem being solved here.
And yes, I would very much love to have a single key that worked for my house, car, safe deposit box, etc. One that isn't my smart phone, of course.
- ashtuchkin 4y agoPrivacy. If someone owns two servers you're logging into, they can associate your logins if you use the same key. Another case is associating you with your GitHub account (as your ssh keys there are public)
- devonkim 4y agoThis is fingerprinting across different identities which is a form of discovery. It’s why I have separate ssh keys for work and personal projects in the first place to better avoid associations across different online identities (with the full understanding that if I’m targeted I’m already against attack vectors that require much more sophisticated defenses). Firstly, for work projects I can give up my private key to my employer as I leave and I won’t care because it was only ever used for work and it would be some reassurance to my colleagues that they can at least access the stuff I used to have access to.
- jonnycomputer 4y agoAssuming you use different keys for different services, the answer would be: privacy.
- mccorrinall 4y agoIf you run a dark net market and your servers are at the risk of being seized, then no, you don’t want stuff like whoami.filippo.io to work. It all depends on your threat model, I guess.