News for hackers. Stuff that matters.

A comment on Introducing unlimited private repositories. Parent comment

Re:Introducing unlimited private repositories by nhaehnle on Wednesday May 11, 2016 @02:02PM (#11677659)
OpenSSH client private keys can be stored encrypted - that's what ssh-agent is for: it allows you to enter the key passphrase only once and then remember it for the rest of your desktop session.

OpenSSH server private keys, on the other hand - I don't think that makes a whole lot of sense. Unless you have a threat model that forces you to encrypt the entire server disk, but then adding private key encryption on top of that doesn't make much sense either.

[ Parent | on HN ]
Re:Introducing unlimited private repositories by geofft on Wednesday May 11, 2016 @02:25PM (#11677864)
Right, exactly. (I did mean to say "server", thanks.) It sounds like the secrets in question are essentially analogous to OpenSSH private keys: they allow a server / service to prove its own identity to others, and the servers should be able to launch automatically at boot so there's not a reasonable place to enter a passphrase.
[ Parent | on HN ]