Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Put SSH keys in .git to make repos USB-portable

dansjots.github.io

Post reply on HN
Print view View original

41–45 of 45 posts

Re: Put SSH keys in .git to make repos USB-portable

#41

Post by webstrand »

OptionOfT wrote: post #38
webstrand wrote: post #27

Earlier quoted context omitted.

I just use -sk variants with a FIDO authenticator. Being able to port the keys to another trusted machine (i.e. replacing a computer) if I need to is nice. And it's as secure as a secure enclave. I do prefer to use a unique key for every (local, remote) pair though. It makes revocation more straightforward.

My main blocker on using `-sk` keys is the fact that I can't get them to work on WSL on Windows.

Oh, if I recall WSL is a Ubuntu VM running on top of Windows, so you'd need to configure USB forwarding for your security key.

Or run ssh-agent on the windows side and forward it into the VM?

Re: Put SSH keys in .git to make repos USB-portable

#42

Post by doug713705 »

nine_k wrote: post #7
ggm wrote: post #4

Any time a proposal to put PRIVATE keys into a portable object is raised, I hope to see discussion of the risks. This is extremely risky for the integrity of the remote copy. If the key is compromised (USB stick lost or acquired by a bad faith actor) then the remote repository is untrustable. I suppose this is no different to normal keyloss, and some people maintain their keys on removable devices and are exposed to…

(1) Won't an SSH key with a passphrase solve this? Whoever picks up the lost USB stick won't be able to guess a good passphrase. (2) It seems like a USB key (like Yubikey) combined with a fair amount os USB-attached storage could be a viable product for some applications! The storage could even be encrypted for (some) extra security.

> (1) Won't an SSH key with a passphrase solve this? Whoever picks up the lost USB stick won't be able to guess a good passphrase.

Yes but in that case your passphrase is your only security. Keeping your private key private, gives you 2 security levels: you must have the key and know the passphrase.

Re: Put SSH keys in .git to make repos USB-portable

#43

Post by perbu »

mnahkies wrote: post #29
cosmic_cheese wrote: post #14

I feel a bit skeeved out about the standard practice of just letting keys hang free and loose in ~/.ssh/ as it is already (leveraging e.g. Secure Enclave on Macs is much better IMO), let alone putting them in a place where they're liable to be unintentionally uploaded or freely accessible to anybody who happens to come into possession of my thumb drive.

I've moved to storing my keys in my password manager, using it as an ssh agent. Means clicking authorize a bit, but also means I'm running a command I'm expecting to use a key then being prompted to authorize (and if it ever prompts unexpectedly I can stop and ask why) Hardware keys would be better, but I think this is a decent balance or security vs convenience for my needs ATM.

I have the same and I'm very happy with UX, but less happy about the key leaving the machine.

Re: Put SSH keys in .git to make repos USB-portable

#44

Post by Ferret7446 »

praash wrote: post #19
heyitsdaad wrote: post #2

Sorry I’m too paranoid about this stuff. I couldn’t get past ”Paste the private key file id_ed25519 into the .git directory of your current repo,”

I stopped worrying after I began protecting all keys with a passphrase.

The only use of the passphrase is to give you time to rotate out the key after it's been compromised. It's not meant to be your main line of defense
Post reply on HN