Re:If you didn't cancel the credit card you used for linode....
by aioprisan on Thursday June 06, 2013 @03:09PM
(#5834532)
You must be kidding. This is encryption 101. The private key is supposed to be moved to a secure location after key generation.
[ Parent
| on HN ]
Re:If you didn't cancel the credit card you used for linode....
by tbrownaw on Thursday June 06, 2013 @03:15PM
(#5834559)
Er, what? I thought the keypair was supposed to be generated in a secure location (such as your 0700 mode ~/.ssh directory), and then only the public half ever leaves.
Re:If you didn't cancel the credit card you used for linode....
by dllthomas on Thursday June 06, 2013 @03:48PM
(#5834746)
As others have said: a private key should never be in an insecure location, or it's no longer secure. You have to generate it in a secure location, and since you're generating the key-pair, you'll have both your public and private keys in the same (secure) location until you remove the public key, which I don't see any strong reason to do.
Re:If you didn't cancel the credit card you used for linode....
by tailrecursion on Thursday June 06, 2013 @03:34PM
(#5834667)
twbrownaw is exactly right. If the private key is already in a secure location then there is no need to move it to a secure location. So, any report that the public keys were stored with the private keys means nothing by itself.
Re:If you didn't cancel the credit card you used for linode....
by jmillikin on Thursday June 06, 2013 @03:49PM
(#5834752)
You are arguing that storing the public and private key in a vault under the ocean is not less secure than just storing the private key there. While that is technically true, it's also missing the point.
Re:If you didn't cancel the credit card you used for linode....
by icebraining on Thursday June 06, 2013 @03:58PM
(#5834808)
How is it missing the point? It tells us that having "both keys in one directory" is, by itself, no evidence of insecurity by Linode.