111–120 of 159 posts
Earlier quoted context omitted.
By default, ssh-keygen leaks info about your computer (``user@host''). Passing -C "" takes care of this. I just throw a script in my ~/bin folder called `keygen`: exec ssh-keygen -t rsa -b 4096 -C "" "$@"
If you're concerned about hostname leakage in your pubkeys, you're almost certainly doing something wrong.
I wish this whole SSH business would be less complicated...
ssh-keygen -t ed25519
many people still using RSA/DSA keys :/ some people are doing even worse things. Last week I saw one man who have shared his priv key by email message!
QWERTY people have to grow up!
Earlier quoted context omitted.
If you're concerned about hostname leakage in your pubkeys, you're almost certainly doing something wrong.
If you want SSH access to Github or Gitlab, you'll need to paste your pubkey there. Leaking your user@host can be a concern if you're trying to maintain anonymity, e.g. Gwern, particularly if your username is your real name. You can strip out the user@host part from the paste, but it's safer to just get rid of it. It's easy to accidentally paste the whole thing into an .ssh/authorized_keys file, for example. Admitted…
Earlier quoted context omitted.
The same arguments were being made in some Reddit threads on the same post; I don't see any reason or new information to point towards RSA 2048 being a questionable or unreasonable choice. If quantum computing becomes more accessible, there will be a quantum shift (forgive the pun) in how we secure our connections.
A shift of a very, very tiny yet discrete amount?
A quantum shift, or quantum leap, in common parlance borrows the discontinuity in energy levels in quantum physics as an analogy for a sudden change (compared to the continuous changes in classical descriptions of physical characteristics).
The size is not always part of the analogy except in that the "quantum shift" is far larger in all circumstances than the infinitesimal changes in classical systems. Relative to an infinitesimal the quantum is huge [analytically it is infinitely larger, but the metaphoric analogy doesn't stretch that far].
FWIW.
Earlier quoted context omitted.
What kind of person cares enough about anonymity to change the comment in their ssh key, but not change the default hostname of their Mac? That person is very inconsistent.
Why does ssh-keygen include unnecessary information by default?
I strip comments from my SSH keys too for the same reason you do. But most people don't seem to care and there is a reason for the default.
Earlier quoted context omitted.
By default, ssh-keygen leaks info about your computer (``user@host''). Passing -C "" takes care of this. I just throw a script in my ~/bin folder called `keygen`: exec ssh-keygen -t rsa -b 4096 -C "" "$@"
If you're concerned about hostname leakage in your pubkeys, you're almost certainly doing something wrong.
Today it's my hostname. Tomorrow ssh-keygen (with default arguments) could start including more sensitive information, like the IPv6 address of my machine that's open to the internet and its exact OS version, and leave me open to a lot of attacks. Hence, I'm not going to trust the default arguments for it.
Earlier quoted context omitted.
If you're concerned about hostname leakage in your pubkeys, you're almost certainly doing something wrong.
No, this is a completely unnecessary piece of information that ssh is unnecessarily jamming into the pubkey. What possible use does including the hostname of the generating machine serve for public key authentication? Today it's my hostname. Tomorrow ssh-keygen (with default arguments) could start including more sensitive information, like the IPv6 address of my machine that's open to the internet and its exact OS ve…
Second, if you don't trust ssh-keygen, why the heck do you use it in the first place?
Earlier quoted context omitted.
What kind of person cares enough about anonymity to change the comment in their ssh key, but not change the default hostname of their Mac? That person is very inconsistent.
Why does ssh-keygen include unnecessary information by default?