One key, on a Nitrokey. Use pgp auth for ssh, sign all of commits
Ask HN: How do you manage your private keys?
11–20 of 20 posts
Re: Ask HN: How do you manage your private keys?
#12Earlier quoted context omitted.
Sorry. Generate new keys for each service, device, client, and server. Don't share them. Don't copy them.
This still isn't very useful. Suppose you have a database, and an elastic number of workers that need to connect.
Still good advice. Generate a keypair on each new machine and only ever move around public keys.
If you are copying over private keys to connect, or reusing private keys, you are doing something wrong.
Re: Ask HN: How do you manage your private keys?
#13There is no good answer if you can’t set up a system that can manage temporary access for your disparate employees.
You can escrow the keys you need off a master and set up hardware devices like yubikeys with word-based passwords unless you want to teach people how to use gpg (you don’t). Then you can put them in tamper evident bags and mail them. You can send unlock passwords once receipt has been confirmed.
Order a laptop with enough USB port types for the systems being used by remote employees in addition to an aegis secure thumb drive. Pull the hard drive and wireless card from the laptop and boot from a Linux live CD for all of the escrow. You can make a local git repo on the thumb drive for version control and store the master as well as stubs, pubs, and private keys. Hell, put the key card passwords in a file on there. Wgaf- that aegis device is going to self-encrypt and format itself if you get the password wrong enough times.
This is all fun and good, but it doesn’t scale. What do you do when you have 20,30,40 employees? What happens when you hire Frank, the non-techie? That’s the guy that needs this the most.
I guess a middle ground is to email out instructions for people to generate key pairs with passwords, have them send in their public keys, and start using something like sssd for ldap based auth where you can store their public keys in their user attributes.
Anyway, it’s still a problem we’re all interested in a push-button answer to.
Re: Ask HN: How do you manage your private keys?
#14I generally have one per user per server if its a Production machine, this is where ssh/.config really helps to keep things organised. This private key never leaves this device.
If it is my own stuff I tend to just have one across most things for ease of use.
I might start looking into some services to manage them but its just easy to be paranoid about moving them off the devices - opens up opportunities!
Re: Ask HN: How do you manage your private keys?
#15Using a different passphrase for each key means you then have the problem of working out where to keep the passphrases. It is a little better in that the passphrase can be stored separately - and realising (compromising?) the asset requires compromise of both the passphrase and the protected key.
The number of entries you describe rather implies that you will need some automation over bringing the key and the passphrase together (e.g. a html5 application connecting to 2 different services with separate authentication).
Re: Ask HN: How do you manage your private keys?
#16Earlier quoted context omitted.
Sorry. Generate new keys for each service, device, client, and server. Don't share them. Don't copy them.
This still isn't very useful. Suppose you have a database, and an elastic number of workers that need to connect.
The most common weak security point in any system is people. If you are sharing keys and you ever need to revoke a shared key, you're in for a bad time
Re: Ask HN: How do you manage your private keys?
#17One key, on a Nitrokey. Use pgp auth for ssh, sign all of commits
What happens if you lose or damage your key? Is there some sort of backup/recovery or fallback scheme?
Re: Ask HN: How do you manage your private keys?
#18Re: Ask HN: How do you manage your private keys?
#19I try to minimize complexity and ideally use a single key for all clients, projects etc. This works well for SSH and reasonable well for PGP. I store my key on a Nitrokey Pro secure USB key so that I can carry it with me and safely use it in any environment. This way I don't have to use separate keys even from the security perspective.
Re: Ask HN: How do you manage your private keys?
#20There is no good answer if you can’t set up a system that can manage temporary access for your disparate employees. You can escrow the keys you need off a master and set up hardware devices like yubikeys with word-based passwords unless you want to teach people how to use gpg (you don’t). Then you can put them in tamper evident bags and mail them. You can send unlock passwords once receipt has been confirmed. Order a…
Thanks for bringing up the non-techie example. Another bummer with the user generating keys, you can't validate a passphrase was used (or that a good one was used) when you just get a public key.