Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yes, because the key is still private. Any other machine to witch you can login with that private key is still off limites.


Ah, I was under the assumption that it is standard practice to have a different key for each machine that you log into.


I think there are no real standard practice or consensus regarding ssh keys and where you need different keys. Some people use one key for each ssh client machine (the machine logged in from), some one key for each ssh server, some use Yubikey to store a single ssh key, etc.

Personally I think one key per client is a good way when not using a hardware security module (e.g. yubikey) as the public key then identifies a unique client machine (e.g. your work laptop). This would help identify which client was breached in an eventual attack. I do think however that I would prefer the Kryptonite solution or using a Yubikey going forward.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: