4 ms·

I agree completely. However if anyone touches my computer: don't you dare f*%king touch my private key. (ditto for my browsers sessions database, google cloud

by dijit 3y ago

I agree completely. However if anyone touches my computer: don't you dare f*%king touch my private key. (ditto for my browsers sessions database, google cloud credentials directory etc;) I'm paranoid about it, but not enough to buy a yubikey, apparently.

lostlogin 3y ago
> However if anyone touches my computer: don't you dare f*%king touch my private key. Touch the computer, sure, but please don’t touch the screen with your filthy grease fingers.
- mdpye 3y ago
  My work laptop has a touchscreen. I've never used it, but other people use it by accident fairly often. Usually only once each though, the look of shock is sometimes even worth the fingerprint :D
- chimprich 3y ago
  I've never understood people who do this. You can point at the screen, tap with a pen, take the mouse or keyboard and move the cursor, etc. but surely it's bad manners to splodge your finger on someone's screen.
JohnFen 3y ago
I'm unusually strict about maintaining a separation between work and personal (for instance, I would never allow my personal smartphone to connect to my employer's WiFi), so I wouldn't use personal keys on a work machine at all. But if those keys (or passwords, etc.) are generated for work purposes, I consider them to be as much company property as the machine itself, so I'm no more protective of them than I am of any other sensitive company data.
- dijit 3y ago
  Interesting thought. How do you feel about giving your colleague your password? My personal opinion is that I can hold someone legally culpable if their account does something like leak financial information; you have a professional responsibility to secure your account from absolutely everyone. Administrators acting on your account must of course be heavily logged and audited, which is the case.
  - JohnFen 3y ago
    > How do you feel about giving your colleague your password? I usually don't, mostly just out of good security habits, but also because most employers specifically prohibit doing that. Almost always, your colleague can be given his own access to whatever the password is for anyway. If that's not possible, then I'll share the password and change it immediately after my colleague doesn't need access anymore. > you have a professional responsibility to secure your account from absolutely everyone. I agree -- that's part of treating credentials the same way as all other sensitive company data. But it's still my employer's data, not mine. If I quit the company or if my supervisor wants to see the contents of my machine, I'm fine with that. The machine and everything on it belongs to the company anyway.
    - dijit 3y ago
      Ok, but your private key, session tokens and CLI access tokens (kube configs, gcloud etc;) are your password in those situations. They tie to your identity, thus you must not treat them the same as company secrets, they are professional personal secrets which should not be disclosed or allowed to fall into anyone elses hands (less they be revoked and cycled). It's not just good security posture it could affect your career quite badly or lead to legal issues.
      - JohnFen 3y ago
        I agree. I don't think I've said anything counter to that (or perhaps I wasn't being clear?) > thus you must not treat them the same as company secrets, they are professional personal secrets They are company secrets that are tied to my identity. The company owns those secrets, not me. Just like my keycard to get into the building.
        dijit 3y ago
        > I agree. I don't think I've said anything counter to that (or perhaps I wasn't being clear?) I think given the context of the thread (don't touch my secrets), saying that you don't have anything you would consider confidential towards your employer or colleagues is a direct contradiction to what I stated. That's why I'm "arguing" because my employer/colleagues should not have access to my private key, ever.

by dijit 3y ago

lostlogin 3y ago

> However if anyone touches my computer: don't you dare f*%king touch my private key. Touch the computer, sure, but please don’t touch the screen with your filthy grease fingers.

mdpye 3y ago
My work laptop has a touchscreen. I've never used it, but other people use it by accident fairly often. Usually only once each though, the look of shock is sometimes even worth the fingerprint :D
chimprich 3y ago
I've never understood people who do this. You can point at the screen, tap with a pen, take the mouse or keyboard and move the cursor, etc. but surely it's bad manners to splodge your finger on someone's screen.

JohnFen 3y ago

I'm unusually strict about maintaining a separation between work and personal (for instance, I would never allow my personal smartphone to connect to my employer's WiFi), so I wouldn't use personal keys on a work machine at all. But if those keys (or passwords, etc.) are generated for work purposes, I consider them to be as much company property as the machine itself, so I'm no more protective of them than I am of any other sensitive company data.

dijit 3y ago
Interesting thought. How do you feel about giving your colleague your password? My personal opinion is that I can hold someone legally culpable if their account does something like leak financial information; you have a professional responsibility to secure your account from absolutely everyone. Administrators acting on your account must of course be heavily logged and audited, which is the case.
- JohnFen 3y ago
  > How do you feel about giving your colleague your password? I usually don't, mostly just out of good security habits, but also because most employers specifically prohibit doing that. Almost always, your colleague can be given his own access to whatever the password is for anyway. If that's not possible, then I'll share the password and change it immediately after my colleague doesn't need access anymore. > you have a professional responsibility to secure your account from absolutely everyone. I agree -- that's part of treating credentials the same way as all other sensitive company data. But it's still my employer's data, not mine. If I quit the company or if my supervisor wants to see the contents of my machine, I'm fine with that. The machine and everything on it belongs to the company anyway.
  - dijit 3y ago
    Ok, but your private key, session tokens and CLI access tokens (kube configs, gcloud etc;) are your password in those situations. They tie to your identity, thus you must not treat them the same as company secrets, they are professional personal secrets which should not be disclosed or allowed to fall into anyone elses hands (less they be revoked and cycled). It's not just good security posture it could affect your career quite badly or lead to legal issues.
    - JohnFen 3y ago
      I agree. I don't think I've said anything counter to that (or perhaps I wasn't being clear?) > thus you must not treat them the same as company secrets, they are professional personal secrets They are company secrets that are tied to my identity. The company owns those secrets, not me. Just like my keycard to get into the building.
      - dijit 3y ago
        > I agree. I don't think I've said anything counter to that (or perhaps I wasn't being clear?) I think given the context of the thread (don't touch my secrets), saying that you don't have anything you would consider confidential towards your employer or colleagues is a direct contradiction to what I stated. That's why I'm "arguing" because my employer/colleagues should not have access to my private key, ever.