Conversation

Notices

1. Aral Balkan (aral@mastodon.ar.al)'s status on Wednesday, 18-Jan-2023 20:08:29 JST Aral Balkan

   Developers, every one of your machines should have its own ssh key. Creating one is very simple. Here’s a handy one-liner by Ben McDonald that you can add as an alias to your dotfiles:

   ssh-keygen -t ed25519 -f $HOME/.ssh/id_ed25519 -C "$(whoami)@$(hostname)-$(date +'%y%m%d')"

   This will create those lovely tiny ed25519 keys that we all know and love (thanks, Daniel!)

   https://www.mebmc.uk/posts/creating_ed25519_ssh_keys.html

   #ssh #security #authentication #ed25519

   • Aral Balkan (aral@mastodon.ar.al)'s status on Wednesday, 18-Jan-2023 22:13:56 JST Aral Balkan

     in reply to

     • Karsten

     @byteborg Because if you’ve installed a malicious native app, it getting your ssh keys is not your only worry. But sure, yes, if you are happy doing what you describe, do that. I don’t know your threat model and I don’t know how you otherwise secure your operating system and environment. I find this acceptable for my threat model and my other security practices and by keeping it simple, if it discourages folks creating one ssh key (via “magic!”) and copying it everywhere, I’ll take that win.

   • Karsten (byteborg@chaos.social)'s status on Wednesday, 18-Jan-2023 22:13:57 JST Karsten

     in reply to

     @aral
     Why this? And why put the key in the filesystem? This makes it very tedious to achieve sufficient overall security in terms of confidentiality of the key.
     Why not create a strong key and put it in a safeguarded Container and inject it into ssh-agent from there?