Subject: IMPORTANT: Mandatory password and ssh key change by 2011-11-30
seg at haxxed.com
Fri Oct 14 04:33:53 UTC 2011
On Thu, Oct 13, 2011 at 11:25 PM, Paul Wouters <paul at xelerance.com> wrote:
> On Thu, Oct 13, 2011 at 10:55:59PM -0500, Callum Lerwick wrote:
>> Its the only right way to do it. As a general rule, a private ssh key
>> should NEVER be transferred off the machine it was generated on.
> Yeah, who needs backups of private keys anyways!
We're talking about SSH keys here. There's no web of trust to lose.
Lose your keys? Generate new ones.
>> you have the same private key on more than one machine at a time,
>> you're Doing It Wrong.
> That's kinda silly. I work on a desktop or on a laptop. When working on
> my desktop, I really don't want to fire up my laptop just for the ssh
> key. And adding two keys in all authorized_keys for this is kinda silly,
> and does not add any security over the one copied key.
You're wrong, and you're doing it wrong.
More information about the devel