3 ms·
Generate a separate SSH key which is only stored in your offsite backup (and then also encrypted with a password), and not on any of your physical machines.
by judofyr 3y ago
Generate a separate SSH key which is only stored in your offsite backup (and then also encrypted with a password), and not on any of your physical machines.
- fbdab103 3y agoI must be missing something. If this novel key only exists inside my backups, it is not registered with any external services, and it cannot be used in the event the primary key is lost. For me to register the backup-only key with other services, it would have to live on my machine, and be simultaneously registered in addition to the primary key. I am not sure what I am gaining vs having a backup of the primary key other than increased operational burden.
- vladvasiliu 3y agoYou can keep just the public part of the backup key on your current device and always enroll the two keys at a time. But yeah, if the main device is stolen, it can be a pain to go update all the services with the new device’s key. I personally use the gpg app on my youbikey for this, and the secret key comes from a backup I install on a livecd.
- fbdab103 3y agoAh duh, keep the public part on the device. However, that very quickly gets into the problem of untested backups. I am then relying completely upon a private key which has never been validated to work.