4 ms·

I'm always tempted to switch to key-based auth myself, but I travel a lot and the thought of me losing my private key and thus being permanently unable to decry

by acabal 14y ago

I'm always tempted to switch to key-based auth myself, but I travel a lot and the thought of me losing my private key and thus being permanently unable to decrypt my files/log in to my servers scares me to death. That's the fatal flaw in the key-based system: while the chances are slim, if you lose the key or it gets stolen (stolen laptop?), the consequences far outweigh the benefits. I'd rather just remembering a complex password for personal encryption/ssh, use a simple throwaway password for general web app use, and not have to worry about losing a key.

dredmorbius 14y ago
Key reissue is really just a slightly modified case of password reset. In my case, for work systems, I'd either fall back on a system password (yes, they exist and can be used, but rarely are, and are secured), or make an out-of-band request to a co-worker. In a larger context, you'd want some way of demonstrating that you are who you claim to be (not a trivial problem, but essentially the same one that exists in the password scenario). A one-time time-limited token would be distributed, notifications sent to your contact address(es), and once on the system you'd generate/provide a fresh key. Keys should, of course be protected. With passwords. As I noted elsewhere, you're not going to eliminate the use of passwords, but you can greatly reduce the threat surface and present problem of huge numbers of readily attacked, weakly secured accounts, many with reused passwords which can be found in existing password corpora.
anonymouz 14y ago
You can simply back up your key (encrypted with a password!) on a cheap USB stick or CD you keep somewhere that you consider safe enough for your purposes.
- charliepark 14y ago
  Or on an encrypted server, like the "secure notes" feature of LastPass.

4 ms·

I'm always tempted to switch to key-based auth myself, but I travel a lot and the thought of me losing my private key and thus being permanently unable to decry

by acabal 14y ago

dredmorbius 14y ago
Key reissue is really just a slightly modified case of password reset. In my case, for work systems, I'd either fall back on a system password (yes, they exist and can be used, but rarely are, and are secured), or make an out-of-band request to a co-worker. In a larger context, you'd want some way of demonstrating that you are who you claim to be (not a trivial problem, but essentially the same one that exists in the password scenario). A one-time time-limited token would be distributed, notifications sent to your contact address(es), and once on the system you'd generate/provide a fresh key. Keys should, of course be protected. With passwords. As I noted elsewhere, you're not going to eliminate the use of passwords, but you can greatly reduce the threat surface and present problem of huge numbers of readily attacked, weakly secured accounts, many with reused passwords which can be found in existing password corpora.
anonymouz 14y ago
You can simply back up your key (encrypted with a password!) on a cheap USB stick or CD you keep somewhere that you consider safe enough for your purposes.
- charliepark 14y ago
  Or on an encrypted server, like the "secure notes" feature of LastPass.