The default OpenSSH key encryption is worse than plaintext

Re:The default OpenSSH key encryption is worse than plaintext by unit91 on Friday August 03, 2018 @04:11PM (#17683215)

> there's little excuses

Yikes that statement has a lot of moral overtones. Is it a good idea to use a Yubi? Arguably yes. Does one need to find "excuses" for not doing so? The vast majority of the time, no.

[ Parent | on HN ]

Re:The default OpenSSH key encryption is worse than plaintext by Latty on Friday August 03, 2018 @05:00PM (#17683565)

I think the intent was more that security keys greatly reduce the friction associated with more secure practices, reducing the reasons to use less secure ones.

[ Parent | on HN ]

Re:The default OpenSSH key encryption is worse than plaintext by lima on Friday August 03, 2018 @04:30PM (#17683367)

No moral overtones intended, the point being that the low cost and the form factor significantly lowers the barrier to entry.

I've been using a GPG smart card for a long time, and it required a separate card reader, and both card and reader were easy to break. A YubiKey 4 fits on a keychain, is hard to break (though some of my colleagues succeeded) and you just plug it in.

[ Parent | on HN ]

Re:The default OpenSSH key encryption is worse than plaintext by amaccuish on Friday August 03, 2018 @09:24PM (#17684876)

I like my smartcards. Bummed they didn't catch on. How do you feel about losing the PIN and using a password? I like how, if I'm at my desk using a hardware PIN pad, it's much less likely i'll have problems.

[ Parent | on HN ]

Re:The default OpenSSH key encryption is worse than plaintext by lima on Friday August 03, 2018 @10:37PM (#17685075)

For SSH, it's fine. The hardware PIN pad does not show which server I'm logging into, so it adds little extra security.

[ Parent | on HN ]