Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is anybody using this private key?

isanybodyusingthisprivatekey.com

Post reply on HN
Print view View original

21–30 of 54 posts

Re: Is anybody using this private key?

#21

Post by IgorPartola »

chrisweekly wrote: post #17
mr_toad wrote: post #13

Earlier quoted context omitted.

Is there any case where they ever need to be shared? If you need a login, generate a new one.

Yeah, I'd strike "except where they're needed". Never share a private key.

One of the best things you can do is generate a key per device, not per person. That way if you lose your phone you just revoke that key and not the one that you use on your tablet, work laptop, home desktop, etc.

Bonus points: monkeysphere and certificate based auth are two other great solutions for making sure the ssh server you log into is not doing a MITM on initial connection (you know, the part where it asks you to manually verify the fingerprint of the server key and you likely just hit y instead).

Forwarding your ssh agent to a host that you don’t know for certain is not doing a MITM attack on you can be devastating, as is entering a password into same.

Re: Is anybody using this private key?

#22

Post by nisegami »

mr_toad wrote: post #13
ignoramous wrote: post #6

Do not give out your private keys anywhere except where they're needed. They are meant to be private for a reason. If this service was serious, it'd instead rely on fingerprints (sha256/sha512) and not the key itself.

Is there any case where they ever need to be shared? If you need a login, generate a new one.

My company's system admins don't know how to do that unfortunately.

Re: Is anybody using this private key?

#26

Post by goopypoop »

ignoramous wrote: post #6

Do not give out your private keys anywhere except where they're needed. They are meant to be private for a reason. If this service was serious, it'd instead rely on fingerprints (sha256/sha512) and not the key itself.

"Never unless necessary" is unhelpful for anything

Re: Is anybody using this private key?

#27

Post by bornfreddy »

nisegami wrote: post #22
mr_toad wrote: post #13

Earlier quoted context omitted.

Is there any case where they ever need to be shared? If you need a login, generate a new one.

My company's system admins don't know how to do that unfortunately.

No worries, I'm sure there are lots of webpages that will generate private keys for them. For free.

Re: Is anybody using this private key?

#28

Post by munchler »

IgorPartola wrote: post #21
chrisweekly wrote: post #17

Earlier quoted context omitted.

Yeah, I'd strike "except where they're needed". Never share a private key.

One of the best things you can do is generate a key per device, not per person. That way if you lose your phone you just revoke that key and not the one that you use on your tablet, work laptop, home desktop, etc. Bonus points: monkeysphere and certificate based auth are two other great solutions for making sure the ssh server you log into is not doing a MITM on initial connection (you know, the part where it asks yo…

But that way you can only use each key on that one device. E.g. No starting a private conversation on your phone and then continuing it on your desktop later.

Re: Is anybody using this private key?

#30

Post by gblargg »

ignoramous wrote: post #6

Do not give out your private keys anywhere except where they're needed. They are meant to be private for a reason. If this service was serious, it'd instead rely on fingerprints (sha256/sha512) and not the key itself.

Scammer: your private key is needed.

Oh, OK.

Post reply on HN