12 ms·

You got flamed for that comment because you called generating SSH keys "scary crypto stuff." If that scares you, you probably also enjoy the simplicity of stori

You got flamed for that comment because you called generating SSH keys "scary crypto stuff." If that scares you, you probably also enjoy the simplicity of storing passwords in plaintext...

talmand 14y ago
I found some of the responses to be as troubling as some found the original post. The responders made assumptions and didn't bother asking why he called it "scary crypto stuff". He might have had a point since new people to all this might have reacted that way. But who cares about that right?
Roritharr 14y ago
What is your problem with someone being scared of crypto stuff? I find this shows the necessary respect when dealing with security related tasks, since they are HARD. I'm not talking about developing crypto related software, but just setting up a "safe" environment where you can store your SSH Keys in a way that doesn't defeat the purpose of using them in the first place is non-trivial, even for people with degrees. IT Security is a complex field of its own and if a user is afraid of making the wrong choice it only shows that he understands the basics of it.
- cmelbye 14y ago
  It's one thing to be scared of the deep inner-workings of OpenSSH (which truly can be scary). It's another thing to be "scared" of ssh-keygen, especially considering it's something that most competent developers will use when managing servers, deploying to Heroku, managing source, etc. "ssh-keygen -t rsa", set a passcode on it, upload the id_rsa.pub and you're done. Demonstrating a lack of understanding of that was worrisome for myself and other users that commented on his post a few weeks ago.
  - Roritharr 14y ago
    Nobody said anything about it being scary to type "ssh-keygen -t rsa" but rather about the responsibility that comes with it. I'd bet my right hand the more than 25% of "competent developers" that are "managing servers" will have made security mistakes while storing their ssh keys on a level with storing the password in plaintext on a .txt file on the desktop. Thats whats scary about "crypto stuff", not that it isn't easy to use the tools, its hard to be really sure how to put them to good use when you are no expert on IT security.
    - drivebyacct2 14y ago
      Outside of checking id_rsa into your Git repo or emailing it, (which would be equivalent to doing so with passwords.txt), SSH (and thus Git) protect you from leaving id_rsa with open permissions. Though it may not be obvious that id_rsa is something to protect. (though again, I don't go emailing random files I don't understand either). That having been said, I'm certainly not a security expert. Are there other common things to look out for to ensure my private key(s) are safe?
      - ansgri 14y ago
        Do I understand right that id_rsa is an equivalent of password.txt in that you have big broblems if someone gets it? In this case I really worry about its being stored in the open in some /users/AppData and not on some TrueCrypt drive that is not mounted by default.
        nknight 14y ago
        This is why you protect it with a passphrase, which SSH asks you to do by default. Choose a good passphrase, it's encrypted on disk, and decrypted only as needed. Seriously guys, you're not even trying. Here are the instructions everyone is freaking out about, they contain an explanation of this very issue. http://help.github.com/win-set-up-git/ http://help.github.com/win-set-up-git/
  - freehunter 14y ago
    Problem is, not everyone who wants to program is willing to go through these steps. Even being a security engineer myself, I balked at some of the steps. I know why they're required, and I understand the steps behind them, but man all I want to do is put this little script somewhere where I don't have to worry about it getting lost. I don't want to have to do it all command-line, I don't want to have to copy and paste from their blog, I don't want to have to do it by hand. I'm not a competent developer (and I reject your assertion that you need to be a competent developer to use version control), I'm not setting up a server, I'm not deploying to Heroku. I want this script backed up and I want it version controlled. No reason why it should be hard. No reason why it should be hard, because the whole goal of technology is to make life easier. I'm scared by the thought of a lot of stuff inside my computer and OS, but luckily there wasn't someone with your mindset and now anyone can easily get a computer from bare metal to running Angry Birds in Chrome. I'm not a developer although I write scripts sometimes, and the barrier to entry should not be set higher than absolutely necessary. If that means GUI, then so be it.
  - jasonkester 14y ago
    The important thing you missed then and are still missing now is that none of that stuff you mention happens in the Windows world. We set up VPNs to our servers and access them via network paths or directly using Remote Desktop. One can go one's entire career without ever typing ssh-keygen into a terminal window. It's certainly not a step involved in setting up a client to talk to version control. You don't have to believe me on this. You can read the article we're talking about here and see this same sentiment expressed by the GitHub team themselves. Thanks to that team, folks in our side of the dev world now have an easy path into Git and GitHub, and can go about our merry way building things without ever having to parse what it was that you did in your second paragraph.
    - ryanbraganza 14y ago
      "Thanks to that team, folks in our side of the dev world now have an easy path into Git and GitHub, and can go about our merry way building things without ever having to parse what it was that you did in your second paragraph." ... except when github messes up, forces you to do a SSH key audit and then you're back to needing to know "scary crypto stuff". ... or when you try and use git outside of github
  - sixothree 14y ago
    > managing servers, deploying to Heroku, managing source I'd hate to say it but if you're introducing someone in Windows land to source control then NONE of the items on that list are part of their skill set.
  - drivebyacct2 14y ago
    I'm surprised that the responses to this amount to, "I don't understand it, don't want to follow instructions and want a two-click GUI". Git isn't magic. To leverage it well, you need to be willing to get down and dirty with the CLI sooner or later. If you're unwilling to learn Git, don't use it. If you're a dev, source control is one of your tools. Learn it or find a tool that holds your hand more. I don't know how it gets more hand-holdy than step by step instructions that take 4 minutes to carry out. Is anyone going to actually reply, or should I continue taking downvotes as "I disagree or I deserve more hand-holding"?
    - darklajid 14y ago
      You're being down-voted into oblivion. You get even more insulting as you're falling down in your edit. Mm disclaimer: I'm a windows dev by day. I introduced git into that shop I'm working at, the rogue 'I set it up, would you technical guys like to work with it' way. This happened 1.5 years earlier, today it's the blessed and only source control in play (ignoring one sad division having to deal with tfs.. Oh the agony). So, I a) was the driving force pushing git and b) work in an environment where unix/linux knowledge is rare and ssh is a weird thing. You are, again and again in this thread, missing the point and just plain insulting. Take it from this guy that types this message from his linux box and has a linux to windows box ratio of 5:1..: The git toolset sucks. It's crap for people that are used to windows only. You can mock people for them being uncomfortable with putty-gen (more likely, btw) or ssh-keygen, but the fact is that it's arcane and unintuitive to do that, if you have no clue what ssh is in the first place. It doesn't help that git really doesn't _need_ ssh. It's just one (well, _the_ one) protocol you can use. I've coworkers that generated their key and didn't keep it afterwards. They thought it's kind of like a registration or that the client will keep this 'stuff' around somewhere. Most 'git doesn't work' errors are related to crappy windows clients being not helpful if the ssh key isn't available (ssh-agent/pageant not running or key not loaded). SSH, in the company I work at, is 'that git stuff'. You consider that funny? Well.. Go ahead. My totally socially awkward inner geek might agree with you, but to the real world you're laughing about a weird kind of a maths joke right now. Most people don't get it, you're mocking things no one cares about and in the end you just look out of place. Don't be that guy and show some understanding.
- nknight 14y ago
  Here's the fundamental problem. If you can't understand very basic security tools and concepts, you cannot securely operate a computer, much less hope to ever write secure code. SSH is one of the easiest security tools to use safely that has ever existed. I would say it is second in usability only to HTTPS in browsers, while having a much better actual security record, and is infinitely more powerful, while keeping basic operation so simple I once taught my mother to use it. I am 100% confident that anyone competently engaged in development or systems administration can understand the basic concepts and operations of SSH in five minutes. Any fear of it is irrational. It is not hard, it was specifically designed not to be hard. I'm equally confident you've not taken the five minutes to understand these relevant concepts, because your statement about setting up a "safe" environment makes no sense in the context of OpenSSH. The defaults are inherently safe, as they should be. You must take specific actions to make the system unsafe.
  - nailer 14y ago
    > Here's the fundamental problem. If you can't understand very basic security tools and concepts, you cannot securely operate a computer, much less hope to ever write secure code. He didn't say he was incapable of understanding it. > SSH is one of the easiest security tools to use safely that has ever existed. I would say it is second in usability only to HTTPS in browsers Perhaps that's true, but I suggest testing it would show a massive discrepancy between ease of HTTPS use and SSH use. In short: I think this is a UX issue, not a PEBCAK one.
    - nknight 14y ago
      There is no UX issue, it's entirely an irrational fear of having to read. Putting it in a GUI accomplishes nothing but clutter the screen with irrelevant crap. nknight@unassigned-hostname:~$ ssh-keygen -t rsa -C "foo@example.com" Generating public/private rsa key pair. Enter file in which to save the key (/home/nknight/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/nknight/.ssh/id_rsa. Your public key has been saved in /home/nknight/.ssh/id_rsa.pub. The key fingerprint is: d3:c0:19:ae:5b:ff:46:fd:a0:b5:9c:a2:93:a4:ca:c2 foo@example.com The key's randomart image is: +--[ RSA 2048]----+ | . | | o o | | = | | . o | | . S . . | | o o. . + | | . . o.o + = | | E. . o.+ + .| | .o. .+.. | +-----------------+ nknight@unassigned-hostname:~$ Read. READ. Comprehend. Don't throw your hands up and say "But it's sooooo confusing!". It's not. It's very simple, and it is not possible to simplify further, no matter how you try to dress it up in eyecandy, you still must read and comprehend the exact same concepts. If you do not, you cannot be secure. Ever. The basic concepts of public key crypto are mandatory knowledge for everybody. Get over your irrational fear and you will have no more trouble than you would reading a technical book.

You got flamed for that comment because you called generating SSH keys "scary crypto stuff." If that scares you, you probably also enjoy the simplicity of storing passwords in plaintext...

talmand 14y ago

I found some of the responses to be as troubling as some found the original post. The responders made assumptions and didn't bother asking why he called it "scary crypto stuff". He might have had a point since new people to all this might have reacted that way. But who cares about that right?

Roritharr 14y ago

What is your problem with someone being scared of crypto stuff? I find this shows the necessary respect when dealing with security related tasks, since they are HARD. I'm not talking about developing crypto related software, but just setting up a "safe" environment where you can store your SSH Keys in a way that doesn't defeat the purpose of using them in the first place is non-trivial, even for people with degrees. IT Security is a complex field of its own and if a user is afraid of making the wrong choice it only shows that he understands the basics of it.

cmelbye 14y ago
It's one thing to be scared of the deep inner-workings of OpenSSH (which truly can be scary). It's another thing to be "scared" of ssh-keygen, especially considering it's something that most competent developers will use when managing servers, deploying to Heroku, managing source, etc. "ssh-keygen -t rsa", set a passcode on it, upload the id_rsa.pub and you're done. Demonstrating a lack of understanding of that was worrisome for myself and other users that commented on his post a few weeks ago.
- Roritharr 14y ago
  Nobody said anything about it being scary to type "ssh-keygen -t rsa" but rather about the responsibility that comes with it. I'd bet my right hand the more than 25% of "competent developers" that are "managing servers" will have made security mistakes while storing their ssh keys on a level with storing the password in plaintext on a .txt file on the desktop. Thats whats scary about "crypto stuff", not that it isn't easy to use the tools, its hard to be really sure how to put them to good use when you are no expert on IT security.
  - drivebyacct2 14y ago
    Outside of checking id_rsa into your Git repo or emailing it, (which would be equivalent to doing so with passwords.txt), SSH (and thus Git) protect you from leaving id_rsa with open permissions. Though it may not be obvious that id_rsa is something to protect. (though again, I don't go emailing random files I don't understand either). That having been said, I'm certainly not a security expert. Are there other common things to look out for to ensure my private key(s) are safe?
    - ansgri 14y ago
      Do I understand right that id_rsa is an equivalent of password.txt in that you have big broblems if someone gets it? In this case I really worry about its being stored in the open in some /users/AppData and not on some TrueCrypt drive that is not mounted by default.
      - nknight 14y ago
        This is why you protect it with a passphrase, which SSH asks you to do by default. Choose a good passphrase, it's encrypted on disk, and decrypted only as needed. Seriously guys, you're not even trying. Here are the instructions everyone is freaking out about, they contain an explanation of this very issue. http://help.github.com/win-set-up-git/ http://help.github.com/win-set-up-git/
- freehunter 14y ago
  Problem is, not everyone who wants to program is willing to go through these steps. Even being a security engineer myself, I balked at some of the steps. I know why they're required, and I understand the steps behind them, but man all I want to do is put this little script somewhere where I don't have to worry about it getting lost. I don't want to have to do it all command-line, I don't want to have to copy and paste from their blog, I don't want to have to do it by hand. I'm not a competent developer (and I reject your assertion that you need to be a competent developer to use version control), I'm not setting up a server, I'm not deploying to Heroku. I want this script backed up and I want it version controlled. No reason why it should be hard. No reason why it should be hard, because the whole goal of technology is to make life easier. I'm scared by the thought of a lot of stuff inside my computer and OS, but luckily there wasn't someone with your mindset and now anyone can easily get a computer from bare metal to running Angry Birds in Chrome. I'm not a developer although I write scripts sometimes, and the barrier to entry should not be set higher than absolutely necessary. If that means GUI, then so be it.
- jasonkester 14y ago
  The important thing you missed then and are still missing now is that none of that stuff you mention happens in the Windows world. We set up VPNs to our servers and access them via network paths or directly using Remote Desktop. One can go one's entire career without ever typing ssh-keygen into a terminal window. It's certainly not a step involved in setting up a client to talk to version control. You don't have to believe me on this. You can read the article we're talking about here and see this same sentiment expressed by the GitHub team themselves. Thanks to that team, folks in our side of the dev world now have an easy path into Git and GitHub, and can go about our merry way building things without ever having to parse what it was that you did in your second paragraph.
  - ryanbraganza 14y ago
    "Thanks to that team, folks in our side of the dev world now have an easy path into Git and GitHub, and can go about our merry way building things without ever having to parse what it was that you did in your second paragraph." ... except when github messes up, forces you to do a SSH key audit and then you're back to needing to know "scary crypto stuff". ... or when you try and use git outside of github
- sixothree 14y ago
  > managing servers, deploying to Heroku, managing source I'd hate to say it but if you're introducing someone in Windows land to source control then NONE of the items on that list are part of their skill set.
- drivebyacct2 14y ago
  I'm surprised that the responses to this amount to, "I don't understand it, don't want to follow instructions and want a two-click GUI". Git isn't magic. To leverage it well, you need to be willing to get down and dirty with the CLI sooner or later. If you're unwilling to learn Git, don't use it. If you're a dev, source control is one of your tools. Learn it or find a tool that holds your hand more. I don't know how it gets more hand-holdy than step by step instructions that take 4 minutes to carry out. Is anyone going to actually reply, or should I continue taking downvotes as "I disagree or I deserve more hand-holding"?
  - darklajid 14y ago
    You're being down-voted into oblivion. You get even more insulting as you're falling down in your edit. Mm disclaimer: I'm a windows dev by day. I introduced git into that shop I'm working at, the rogue 'I set it up, would you technical guys like to work with it' way. This happened 1.5 years earlier, today it's the blessed and only source control in play (ignoring one sad division having to deal with tfs.. Oh the agony). So, I a) was the driving force pushing git and b) work in an environment where unix/linux knowledge is rare and ssh is a weird thing. You are, again and again in this thread, missing the point and just plain insulting. Take it from this guy that types this message from his linux box and has a linux to windows box ratio of 5:1..: The git toolset sucks. It's crap for people that are used to windows only. You can mock people for them being uncomfortable with putty-gen (more likely, btw) or ssh-keygen, but the fact is that it's arcane and unintuitive to do that, if you have no clue what ssh is in the first place. It doesn't help that git really doesn't _need_ ssh. It's just one (well, _the_ one) protocol you can use. I've coworkers that generated their key and didn't keep it afterwards. They thought it's kind of like a registration or that the client will keep this 'stuff' around somewhere. Most 'git doesn't work' errors are related to crappy windows clients being not helpful if the ssh key isn't available (ssh-agent/pageant not running or key not loaded). SSH, in the company I work at, is 'that git stuff'. You consider that funny? Well.. Go ahead. My totally socially awkward inner geek might agree with you, but to the real world you're laughing about a weird kind of a maths joke right now. Most people don't get it, you're mocking things no one cares about and in the end you just look out of place. Don't be that guy and show some understanding.
nknight 14y ago
Here's the fundamental problem. If you can't understand very basic security tools and concepts, you cannot securely operate a computer, much less hope to ever write secure code. SSH is one of the easiest security tools to use safely that has ever existed. I would say it is second in usability only to HTTPS in browsers, while having a much better actual security record, and is infinitely more powerful, while keeping basic operation so simple I once taught my mother to use it. I am 100% confident that anyone competently engaged in development or systems administration can understand the basic concepts and operations of SSH in five minutes. Any fear of it is irrational. It is not hard, it was specifically designed not to be hard. I'm equally confident you've not taken the five minutes to understand these relevant concepts, because your statement about setting up a "safe" environment makes no sense in the context of OpenSSH. The defaults are inherently safe, as they should be. You must take specific actions to make the system unsafe.
- nailer 14y ago
  > Here's the fundamental problem. If you can't understand very basic security tools and concepts, you cannot securely operate a computer, much less hope to ever write secure code. He didn't say he was incapable of understanding it. > SSH is one of the easiest security tools to use safely that has ever existed. I would say it is second in usability only to HTTPS in browsers Perhaps that's true, but I suggest testing it would show a massive discrepancy between ease of HTTPS use and SSH use. In short: I think this is a UX issue, not a PEBCAK one.
  - nknight 14y ago
    There is no UX issue, it's entirely an irrational fear of having to read. Putting it in a GUI accomplishes nothing but clutter the screen with irrelevant crap. nknight@unassigned-hostname:~$ ssh-keygen -t rsa -C "foo@example.com" Generating public/private rsa key pair. Enter file in which to save the key (/home/nknight/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/nknight/.ssh/id_rsa. Your public key has been saved in /home/nknight/.ssh/id_rsa.pub. The key fingerprint is: d3:c0:19:ae:5b:ff:46:fd:a0:b5:9c:a2:93:a4:ca:c2 foo@example.com The key's randomart image is: +--[ RSA 2048]----+ | . | | o o | | = | | . o | | . S . . | | o o. . + | | . . o.o + = | | E. . o.+ + .| | .o. .+.. | +-----------------+ nknight@unassigned-hostname:~$ Read. READ. Comprehend. Don't throw your hands up and say "But it's sooooo confusing!". It's not. It's very simple, and it is not possible to simplify further, no matter how you try to dress it up in eyecandy, you still must read and comprehend the exact same concepts. If you do not, you cannot be secure. Ever. The basic concepts of public key crypto are mandatory knowledge for everybody. Get over your irrational fear and you will have no more trouble than you would reading a technical book.