Hacker News Reader

Comment by sliken | Hacker News Reader

Much of security improvements these days are not just enabling better security, but making them easy and default.

Sure it's possible to: have a strong password, use it only for a single machine, keep it in a good password safe, never reuse it anywhere, have the discipline to not make it short/easy to type/easy to remember, change it every time a server is compromised, etc....

Or you could get all that for free with public keys. Yes a private key is like a very long password, but the important part is that it never leaves the client side and it's safe to use on every computer you want access to without the hassle of remembering one password per server.

If you access many machines, how will you know when one is compromised? How will you prevent an attacker from logging in as you?

Public keys really are the better way to handle user auth, less of a minefield for regular users.

View on HN

> If you access many machines, how will you know when one is compromised? How will you prevent an attacker from logging in as you?

Even better is to use SSH certificates. That way you don't have to deal with authorized (usually permanent) keys.

Once the SSH CA is installed in the host, the client can generate temporary asymmetric keys and sign them with the CA key before every connection.

There are a few ways to set up this scenario, here's one using Vault:

https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-cert...

Not sure that's any better in security terms. It has some ease of use and central management benefits but also some significant complexity (setup and maintenance of a CA).

My setups just used puppet to manage a authorized key directory on each machine (basically one line of code), assuming you have a working puppet setup of course.

I'd consider either approach significantly more secure than passwords which is a much worse approach.

> Public keys really are the better way to handle user auth, less of a minefield for regular users.

I'll go along with that, thou i consider a secret that resides in my brain vastly more secure than one residing on my disk.

I 100% agree. But with ssh (ideally) the passphrase never leaves the computer you are physically touching.

With passwords you are sending it to remote computers where it could be compromised. Thus the standard practice of forcing all users to change their passwords when a server is compromised.

I've come to realize that if I don't use a password at least once per month, I will forget it.

...so, this isn't great advice either. Password vaults are important..... at which point, you can just use a complex unique password.

Okay, so use the 56 bits that you can store in your head as a passphrase to control the 256 bits (for ed25519) on your disk.

Reply on news.ycombinator.com