News for hackers. Stuff that matters.

A comment on Secretive – macOS native app to store SSH keys in the Secure Enclave.

Re:Secretive – macOS native app to store SSH keys in the Sec... by old-gregg on Saturday June 27, 2020 @10:46PM (#23666432)
For the love of God, please stop using SSH keys. Almost every "company X is hacked" title on HN can be traced to leaked SSH credentials.

Use auto-expiring certificates that are issued after a proper SSO+2FA flow:

https://gravitational.com/blog/how-to-ssh-properly/

[ Parent | on HN ]
Re:Secretive – macOS native app to store SSH keys in the Sec... by resfirestar on Sunday June 28, 2020 @02:07AM (#23667031)
> Almost every "company X is hacked" title on HN can be traced to leaked SSH credentials.

I don’t think that’s anywhere close to true but I’d be interested if you have reason to believe it is or some examples. Or maybe it’s intentional hyperbole?

[ Parent | on HN ]
Re:Secretive – macOS native app to store SSH keys in the Sec... by kortilla on Sunday June 28, 2020 @02:36AM (#23667114)
Intentional hyperbole to sling blog spam. That link is to a site the OP claims in profile.
[ Parent | on HN ]
Re:Secretive – macOS native app to store SSH keys in the Sec... by ikiris on Sunday June 28, 2020 @02:34AM (#23667104)
Most of the time, you're lucky to get people to move off of passwords
[ Parent | on HN ]