Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is anybody using this private key?

isanybodyusingthisprivatekey.com

Post reply on HN
Print view View original

41–50 of 54 posts

Re: Is anybody using this private key?

#41

Post by IgorPartola »

munchler wrote: post #28
IgorPartola wrote: post #21

Earlier quoted context omitted.

One of the best things you can do is generate a key per device, not per person. That way if you lose your phone you just revoke that key and not the one that you use on your tablet, work laptop, home desktop, etc. Bonus points: monkeysphere and certificate based auth are two other great solutions for making sure the ssh server you log into is not doing a MITM on initial connection (you know, the part where it asks yo…

But that way you can only use each key on that one device. E.g. No starting a private conversation on your phone and then continuing it on your desktop later.

The service you use should allow you to add more than one key and create a symmetric encryption key for the conversion. Your private key identifies your device, the service should know that you own multiple devices.

Re: Is anybody using this private key?

#43

Post by msgodel »

IgorPartola wrote: post #21
chrisweekly wrote: post #17

Earlier quoted context omitted.

Yeah, I'd strike "except where they're needed". Never share a private key.

One of the best things you can do is generate a key per device, not per person. That way if you lose your phone you just revoke that key and not the one that you use on your tablet, work laptop, home desktop, etc. Bonus points: monkeysphere and certificate based auth are two other great solutions for making sure the ssh server you log into is not doing a MITM on initial connection (you know, the part where it asks yo…

Are there really people who don't do this? Copying private keys around just feels gross like copying binaries around.

Re: Is anybody using this private key?

#46

Post by uniqueusername7 »

mr_toad wrote: post #13
ignoramous wrote: post #6

Do not give out your private keys anywhere except where they're needed. They are meant to be private for a reason. If this service was serious, it'd instead rely on fingerprints (sha256/sha512) and not the key itself.

Is there any case where they ever need to be shared? If you need a login, generate a new one.

How would I get my ssh keys to the remote server from a new machine? To me, the easiest way seems to be either sharing private keys from a different machine, or having some way to deterministically generate keys from a password or keyphrase, and the latter seems more secure to me because I don't have to trust a middle man to do the transferring.

Re: Is anybody using this private key?

#48

Post by nativeit »

yieldcrv wrote: post #19
ivanjermakov wrote: post #8

> Guys this is just a meme website. Please do not submit your real private key and do not report phishing. Exactly what a phishing website would say.

I would also provide an open source version that also was backdoored

Written in Rust or Go.

Re: Is anybody using this private key?

#50

Post by nativeit »

knowitnone wrote: post #44

Generate and send it every possible key

> The maximum cycle length is 2256 ≈ 1.16×10^77 iterations. If you can evaluate 10^12 hashes per second, then working your way through all possible hashes would take you about 10^65 seconds (about one quindecillion times the age of the earth). Even if you're fortunate enough find a loop in a tiny fraction of that time, you're still liable to be waiting for trillions of years.

https://stackoverflow.com/a/43636715

Edit: fixed missing exponent notation

Post reply on HN