News for hackers. Stuff that matters.

A comment on Sign arbitrary data with your SSH keys. Parent comment

Re:Sign arbitrary data with your SSH keys by jonnycomputer on Saturday November 13, 2021 @08:05AM (#29209464)
>Your Pubkey can be used to cross-match multiple identities. Example: You have different coding personae. One that is activist, one that is company-peon. Different accounts, same SSH pubkey in Github or other server with publicly listed pubkeys --> Same person confirmed.

How to practically manage this, with git in particular.

[ Parent | on HN ]
Re:Sign arbitrary data with your SSH keys by fstelzer on Saturday November 13, 2021 @08:52AM (#29209696)
You can configure which key to use when signing your work https://git-scm.com/docs/git-config#Documentation/git-config...

i see that the docs are missing info on ssh there still. i will update this since with 2.34 you can also specify a ssh publik key literally in this variable or point it to a file with it.

[ Parent | on HN ]
Re:Sign arbitrary data with your SSH keys by jonnycomputer on Saturday November 13, 2021 @09:01AM (#29209755)
Ah, this is what I was looking for. Thank you.
[ Parent | on HN ]
Re:Sign arbitrary data with your SSH keys by hirundo on Saturday November 13, 2021 @08:16AM (#29209500)
Generate a different public key for each service. Don't use the one for github, etc., anywhere else.
[ Parent | on HN ]
Re:Sign arbitrary data with your SSH keys by newaccount74 on Saturday November 13, 2021 @08:26AM (#29209537)
OpenSSH by default tries authenticating with all your identities. You should probably turn that off too.
[ Parent | on HN ]
Re:Sign arbitrary data with your SSH keys by dspillett on Saturday November 13, 2021 @09:26AM (#29209944)
Or keep sensitive identities in a different location, so they aren't automatically picked up like that. That forces you to specify an identity file when you need one of those, but that small inconvenience is probably not a concern if the identity is that sensitive.
[ Parent | on HN ]