3 ms·
All of your items are just "i'm doing this wrong" combined with not understanding how keys even work. Your private keys shouldn't even be accessible to you, th
by ikiris 3y ago
All of your items are just "i'm doing this wrong" combined with not understanding how keys even work.
Your private keys shouldn't even be accessible to you, they should be on a secure enclave like a yubikey, and you should forward the token along the chains. No risks, and basically painless, especially if you switch to certs so you don't even have to know the public keys ahead of time on the servers, just all trust the same private PKI.
- lxgr 3y ago> Your private keys shouldn't even be accessible to you, they should be on a secure enclave like a yubikey That’s not the only reason or way to use SSH keys. Even when stored on disk (in plaintext or encrypted) they offer advantages over password authentication, e.g. making it impossible for an MITM to steal credentials or impersonate an authenticated client even without validating host keys.
- freedomben 3y agoGP is deeply concerned about getting locked out, and your solution is to use a secure enclave?
- ikiris 3y agowith certs its not a problem to swap keys out.