4 ms·
Do you recognize the threat of malware (such as a random script you download) just copying the private key and shipping it off? A passphrase defeats that threa
by talaketu 15y ago
Do you recognize the threat of malware (such as a random script you download) just copying the private key and shipping it off?
A passphrase defeats that threat. And integrating the ssh agent with something like the gnome keyring means you never even have to remember your passphrase.
- mapgrep 15y agoI confess, I hadn't thought of that threat. It's an interesting thing to think about. My initial reaction is this: Couldn't malware on my laptop also monitor my keystrokes when I unlock the key? Or when I log in to my VPS web interface? I mean, if the goal is to have a malware infested computer that is no threat to external systems, it seems like there are tons of other files/apps/system you'd also want to password protect, to the point of making the computer almost impossible to use. Still, it's an interesting point. SSH keys are more sensitive. I do keep an extra password on my password manager.
- blibble 15y agoaye, it's pretty easy to ptrace() ssh-agent and extract the key directly from memory. once malicious third party code has executed on your machine as you it's game over.
- ashconnor 15y agoThe same malware could run VNC or log a password too.