Comment by paulddraper | Hacker News Reader

Comment by paulddraper | Hacker News Reader

Parent Full thread

> you cannot reset your forgotten private SSH key.

You can though. If you lose your private SSH key, you regenerate it, and the server admin resets your public key. Zero data loss.

I think the better analogy would have have been a disk encryption key. But note that consumer facing encryption tech (Mac, Windows) generally doesn't stick to "user forgot key = user lost data".

> So, it's a feature. You may not want this feature, though.

Yeah, I must agree I do not want this.

I understand it is more secure but it is also more user hostile.

I'll take the risk of a compromised admin (assuming strong password and TFA of course) over "sorry you lost all your data."

Data integrity is just as much a part of security as data privacy.

> If you lose your private SSH key, you regenerate it, and the server admin resets your public key. Zero data loss.

This is exactly the same data loss as when you lose your master password.

Just like you store multiple passwords in your password vault, your SSH key can give you access to multiple servers.

If you lose it, you have to "reset" your public key on _every_ server, just like you have to reset _every_ password that you stored in your password vault.

That's true.

Though of the purposes of having password manager is managing with large numbers of disparate systems.

Whereas an SSH is simply the authentication mechanism, and may or may not be shared across large numbers of systems.

Though whatever data is "lost" in a password manager is usually recoverable; each password could be individually reset in each website. True though that it's a pain.

> each password could be individually reset in each website.

Usually.

HN passwords are not always recoverable. (Only if you have entered an email address).

Unless the admin has access to all the places where your public SSH key was used, and reinstate the access for you, it's not going to help.

By the same token, if the admin did not have access to all the sites and your passwords, the admin can set a new master password, but cannot restore the access to the sites.

Reply on news.ycombinator.com