Hacker News
points by traceroute66 2 days ago | 0 comments
> No need to be so absolutist.

Why not ?

Even if you don't want to go all the way to SSH certificates, SSH public-key authentication is laughably easy to do.

I also don't buy the argument "but its on a ULA address". Attacker's old favourite these days is finding a way in (North–South) and then using that as a stepping stone (East–West). Also the general concept of "lower security is OK because its on the LAN" is so 1997.

[–] kccqzy 2 days ago
Yeah because if attackers are already finding a way in, they can easily read my ~/.ssh/id_ed25519. A password is strictly better, although not by much because lateral movement is very easy anyways. The only exception is if the private key is actually on a HSM, which is the case for all my SSH private keys on iOS.
[–] cozzyd 2 days ago
or password protect your key, at least.
[–] traceroute66 2 days ago
> read my ~/.ssh/id_ed25519.

No excuse for doing that these days.

You can use a Yubikey or you can use your computer's secure enclave or TPM with FIDO at no extra cost.

A password is never, ever "strictly better". Seriously, you're just making shit up now.

[–] kccqzy 2 days ago
Your comment is self-contradictory. In one sentence you say “these days” and in another you say “never, ever.” These are contradictory. What if your computer is so old that it doesn’t have a TPM?

I was already pointing out that if you have secure enclave for your private key you should use key-based authentication. That’s what I do on iOS. Otherwise a password is better than your private key in plain text on disk. So much malware steal your private SSH keys (along with your other saved passwords and browser cookies); no malware that I know of performs social engineering and tricks you into giving up your SSH passwords.