News for hackers. Stuff that matters.
Re:A sane SSH(1) key management example by bityard on Thursday August 18, 2022 @11:53AM (#32511312)
SSH public keys are called public keys because they're totally safe to distribute anywhere. That's rather the entire point of asymmetric cryptography.

So I guess I don't really understand the problem being solved here.

And yes, I would very much love to have a single key that worked for my house, car, safe deposit box, etc. One that isn't my smart phone, of course.

Re:A sane SSH(1) key management example by ashtuchkin on Thursday August 18, 2022 @12:48PM (#32512031)
Privacy. If someone owns two servers you're logging into, they can associate your logins if you use the same key. Another case is associating you with your GitHub account (as your ssh keys there are public)
Re:A sane SSH(1) key management example by devonkim on Thursday August 18, 2022 @01:21PM (#32512427)
This is fingerprinting across different identities which is a form of discovery. It’s why I have separate ssh keys for work and personal projects in the first place to better avoid associations across different online identities (with the full understanding that if I’m targeted I’m already against attack vectors that require much more sophisticated defenses). Firstly, for work projects I can give up my private key to my employer as I leave and I won’t care because it was only ever used for work and it would be some reassurance to my colleagues that they can at least access the stuff I used to have access to.
Re:A sane SSH(1) key management example by mccorrinall on Thursday August 18, 2022 @12:49PM (#32512048)
If you run a dark net market and your servers are at the risk of being seized, then no, you don’t want stuff like whoami.filippo.io to work.

It all depends on your threat model, I guess.

Re:A sane SSH(1) key management example by jonnycomputer on Thursday August 18, 2022 @12:49PM (#32512040)
Assuming you use different keys for different services, the answer would be: privacy.