8 ms·

Excuse me, what? FUD? I wasn't spreading FUD, I was saying that people overuse shared keys and end up putting themselves in situations where they are open to ea

by druiid 14y ago

Excuse me, what? FUD? I wasn't spreading FUD, I was saying that people overuse shared keys and end up putting themselves in situations where they are open to easy exploitation if they don't use them right. People will generate a key and the put it on their dev machine, backup machines and similar all which are generally less secure than production devices. Someone figures out a way in and boom. How is this FUD? It happens in real-world usage when people don't take the time to consider how they should be properly using shared keys.

moe 14y ago
people overuse shared keys This is not a drawback of key-based authentication versus passwords because you have the exact same problem with passwords. If you want to explain proper key-management then explain it. But don't make it sound as if key-auth was some esoteric option that should be carefully considered versus password auth. Key auth should always be the default and password auth should always be disabled, exceptions to this rule are very rare.