4 ms·
One of the best things you can do is generate a key per device, not per person. That way if you lose your phone you just revoke that key and not the one that yo
by IgorPartola 1y ago
One of the best things you can do is generate a key per device, not per person. That way if you lose your phone you just revoke that key and not the one that you use on your tablet, work laptop, home desktop, etc.
Bonus points: monkeysphere and certificate based auth are two other great solutions for making sure the ssh server you log into is not doing a MITM on initial connection (you know, the part where it asks you to manually verify the fingerprint of the server key and you likely just hit y instead).
Forwarding your ssh agent to a host that you don’t know for certain is not doing a MITM attack on you can be devastating, as is entering a password into same.
- munchler 1y agoBut that way you can only use each key on that one device. E.g. No starting a private conversation on your phone and then continuing it on your desktop later.
- IgorPartola 1y agoThe service you use should allow you to add more than one key and create a symmetric encryption key for the conversion. Your private key identifies your device, the service should know that you own multiple devices.
- msgodel 1y agoAre there really people who don't do this? Copying private keys around just feels gross like copying binaries around.