4 ms·

Just don't use SSH keys at all. Anywhere. https://substack.com/@rakkhi/note/c-40163543?r=1afqp https://substack.com/@rakkhi/note/c-40163543?r=1afqp

by rakkhi 3y ago

johnklos 3y ago
That's shortsighted. Why not go all the way and just stop using computers altogether?
lxgr 3y ago
Huh? So what should we use to e.g. SSH to a server to debug a crashed or hanging process, login to a dev instance etc.? SSH keys are also not “just long passwords” at all.
cortesoft 3y ago
Not using SSH to configure a machine is smart, but saying no SSH at all is not feasible for many things. When something goes wrong, you need to be able to connect to a running machine and poke around, and you don’t know how you will need to poke until you are doing it.
gruturo 3y ago
The statement "SSH keys are just long passwords" in your linked post is a huge red flag that you don't understand enough about how they work and are in no position to dispense advice (that anyone sane should heed) on the subject. To start (but it would be a longer discussion), passwords can be captured as you type them into a compromised host, SSH keys can't. Also SSH keys can reside on a security device (TPM, smartcard, HSM, security token, whatever) and this way they can _never_ be captured, barring exploits on those hardware devices, even if your workstation is compromised. Some hardware security devices have features like touch-to-authorize, or even biometrics, for every single usage. SSH keys can be _used_ while unlocked, but not from a compromised remote site (unless you do agent forwarding, which this article is all about), and never captured from there. Passwords have literally _none_ of the above features. Forwarding usually bad. SSH Keys otherwise good. Passwords so bad they're not worth comparing to anything. (and yeah, there's stuff even better than SSH keys)

4 ms·

Just don't use SSH keys at all. Anywhere. https://substack.com/@rakkhi/note/c-40163543?r=1afqp https://substack.com/@rakkhi/note/c-40163543?r=1afqp

by rakkhi 3y ago

Just don't use SSH keys at all. Anywhere. https://substack.com/@rakkhi/note/c-40163543?r=1afqp https://substack.com/@rakkhi/note/c-40163543?r=1afqp

johnklos 3y ago
That's shortsighted. Why not go all the way and just stop using computers altogether?
lxgr 3y ago
Huh? So what should we use to e.g. SSH to a server to debug a crashed or hanging process, login to a dev instance etc.? SSH keys are also not “just long passwords” at all.
cortesoft 3y ago
Not using SSH to configure a machine is smart, but saying no SSH at all is not feasible for many things. When something goes wrong, you need to be able to connect to a running machine and poke around, and you don’t know how you will need to poke until you are doing it.
gruturo 3y ago
The statement "SSH keys are just long passwords" in your linked post is a huge red flag that you don't understand enough about how they work and are in no position to dispense advice (that anyone sane should heed) on the subject. To start (but it would be a longer discussion), passwords can be captured as you type them into a compromised host, SSH keys can't. Also SSH keys can reside on a security device (TPM, smartcard, HSM, security token, whatever) and this way they can _never_ be captured, barring exploits on those hardware devices, even if your workstation is compromised. Some hardware security devices have features like touch-to-authorize, or even biometrics, for every single usage. SSH keys can be _used_ while unlocked, but not from a compromised remote site (unless you do agent forwarding, which this article is all about), and never captured from there. Passwords have literally _none_ of the above features. Forwarding usually bad. SSH Keys otherwise good. Passwords so bad they're not worth comparing to anything. (and yeah, there's stuff even better than SSH keys)