Post

Kiran Jonnalagadda
@jackerhack.ing

How do you manage your SSH private keys? Separate keys on each of your devices? Stored in secure enclave where available? Or the same key(s), copied over manually? Or via a password manager that has ssh-agent functionality? Life was simple when I only had a laptop and phone. Now I need a plan.

0 reposts1 like

Jitin
@jitin.xyz

Separate keys for each device. Once created, it’s added to GitHub. And then on the new device, I use ssh-import-id to “sync” all my other keys.

Kiran Jonnalagadda
@jackerhack.ing

Isn't wanton ssh-import-id a bit of a security risk? It depends on your GitHub account being secure and it's potentially adding too many keys to a server that's now vulnerable to any of your devices becoming compromised.

Jitin
@jitin.xyz

There is some risk of course, but I usually rotate keys in maybe six months or so, all my accounts have 2FA, other measures etc. which help a bit I had some incident losing access because one of my devices crashed so then I switched to the GitHub route for the convenience. This reminded me of:

Kiran Jonnalagadda
@jackerhack.ing

Devices without encrypted filesystems and strong lockscreens are a worry. For instance, I need to test code on an SBC, but those typically have no disk encryption and have autologin enabled, so how do I de-risk them?