News for hackers. Stuff that matters.
Re:Sign arbitrary data with your SSH keys by justusthane on Saturday November 13, 2021 @10:34AM (#29210457)
No, it’s not. It’s not the same as reusing a password, because unlike a password, your private key never leaves your local machine. It doesn’t matter if one of the services that you’re using the key pair to authenticate to is compromised—your private key is still safe.

In order to compromise your private key the attacker would have to gain access to your local machine, in which case all of your private keys are compromised.

You should use different key pairs per client, so that if one client machine is compromised you don’t have to change keys on the rest of them.

There are no comments on this comment yet.