News for hackers. Stuff that matters.
Re:Ask HN: What are the best practises for using SSH keys? by regularfry on Sunday September 25, 2016 @09:35AM (#12575241)
The first rule: never share a private keys between physical devices. Apart from reducing the opportunities for it to go walkies in transit, or accidentally get left on a USB stick, it allows you to revoke a single credential if you lose (control over) that device.

From that, we get:

  - you're not sharing passphrases between keys, you're 
  sharing them between devices, and whether that's safe
   depends how likely it is that a compromised passphrase 
  on one device can be transferred by an attacker to another.
  - Similarly, whether a blank passphrase is a good idea or
   not depends on what other measures are protecting access 
  to that private key.
  - If a private key ever turns up on the wrong machine, 
  you *know* the key and both source and destination 
  machines have been compromised.
Re:Ask HN: What are the best practises for using SSH keys? by lawpoop on Monday September 26, 2016 @01:03PM (#12583533)
If I understand this properly, how do you use the same identity from two different machines on a service like github?

If they only allow you to upload one public key per account, then you aren't able to use that account on both your desktop and laptop, if you have separate private keys on them, no?

Edit: Actually I just looked at github and they allow multiple keys. Is it generally the case that any service that offers ssh keys will allow multiple keys?

Re:Ask HN: What are the best practises for using SSH keys? by regularfry on Wednesday September 28, 2016 @04:44PM (#12601214)
There's no reason not to. The `authorized_keys` file on a host does exactly that. Whether a specific service does the same is down to that service.
Re:Ask HN: What are the best practises for using SSH keys? by lawpoop on Thursday September 29, 2016 @12:33PM (#12606605)
How do you revoke the keys when a machine a compromised? Log in to each service and remove it when you become aware?