Hacker News new | past | comments | ask | show | jobs | submit login

All of your items are just "i'm doing this wrong" combined with not understanding how keys even work.

Your private keys shouldn't even be accessible to you, they should be on a secure enclave like a yubikey, and you should forward the token along the chains. No risks, and basically painless, especially if you switch to certs so you don't even have to know the public keys ahead of time on the servers, just all trust the same private PKI.




> Your private keys shouldn't even be accessible to you, they should be on a secure enclave like a yubikey

That’s not the only reason or way to use SSH keys. Even when stored on disk (in plaintext or encrypted) they offer advantages over password authentication, e.g. making it impossible for an MITM to steal credentials or impersonate an authenticated client even without validating host keys.


GP is deeply concerned about getting locked out, and your solution is to use a secure enclave?


with certs its not a problem to swap keys out.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: