Hacker News Reader

Comment by vbezhenar | Hacker News Reader

With Linux if I'm a program running under target user, I can use unlocked ssh-agent to perform crypto operations with private key, but I can't extract the key itself. With Windows I can just steal the key itself. I think Windows is worse here. Am I misunderstanding something? What's the point of password protection if key is stored unprotected by this password in the registry?

View on HN

The private key is stored password-protected in the registry. DPAPI, the API used to protect the private key, encrypted based on the user's Windows account password, and allows decryption without further password entry by the already-logged-on user. There isn't an equivalent API in the Unix world that I'm aware of. When you fire-up the Windows SSH agent no password entry is necessary, because the password used to logon to Windows is also used to decrypt the stored private key. In a Unix environment you'd need to enter a passphrase to allow the SSH agent to decrypt the key.

The equavilent in the unix world is gnome keyring (or any other Secret Service spec implementation) unlocked by a PAM module on login.

The keys are protected in the registry with the current user context. You need administrator permissions on Windows to get the private keys, comparable to OSX or Linux

I don't know if I missed your point but right now I can export a private key using seahorse, a key manager program, very easily not using its password.

Reply on news.ycombinator.com