News for hackers. Stuff that matters.
Re:Ask HN: What are the best practises for using SSH keys? by vitus on Sunday September 25, 2016 @01:29PM (#12576271)
I was originally going to post something along these lines, but then I realized that this argument doesn't work the same in this particular context, and the parent isn't necessarily arguing against password stores in general. Sure, it might be better (in the sense of not concentrating your risk to a single file) to have a strong (importantly, private) scheme for creating passwords (say, based on the site and account name). But if you're restricted to some inane restrictions ("6-10 alphanumeric characters"), then there's not really a strong argument against a password manager in this case.

Sure, in general, you want to avoid password reuse to isolate password compromises / security breaches (some companies are still storing passwords in plaintext in 2016, ugh). But in this case, we're talking about private keys that should never leave your local machine. If those are compromised (even passphrase-protected), then it's not inconceivable to think that your password store might also be compromised.

Re:Ask HN: What are the best practises for using SSH keys? by a3n on Sunday September 25, 2016 @01:51PM (#12576377)
> he parent isn't necessarily arguing against password stores in general.

Yeah, reliazed that, my post was just my "logical" progression.