4 ms·
Honestly, I don't get the point of it. SSH keys, unlike PGP keys, are meant to be disposable and don't carry any identity information. If anything, I'd rather u
by andrewshadura 3y ago
Honestly, I don't get the point of it. SSH keys, unlike PGP keys, are meant to be disposable and don't carry any identity information. If anything, I'd rather use my PGP keys with SSH (an option available for about a decade I think).
- wolletd 3y agoPeople don't get the security concepts. Probably, just a lot of people wanted signed commits because they somehow "better", but couldn't get PGP to work. But they use SSH keys to push to GitHub anyway, so someone added the option to use SSH keys to sign Git commits. Now everyone can have a green "Verified" symbol on their commits. It's worth less, but it looks better!
- thrwwycbr 3y agoChecklist security in a nutshell. Does it have a checkmark? Yes? Must be secure then.
- SAI_Peregrinus 3y agoMost users are using `git` with some sort of server, and authenticating their development system(s) to that server with SSH. Git-over-SSH support is built in to `git`. Using the same key to that already identifies and authenticates you to the server is more convenient than needing a second, parallel PKI set up.