Hacker News new | past | comments | ask | show | jobs | submit login

If you have one key, and use it for N services, compromising your key compromises N accounts. If you use one key per service, compromising a key only compromises one account.



If you have your N private keys all stored on the same device (such as side-by-side in your ~/.ssh/keys directory, as in ryan-c's example upthread), under what scenario would just one of those keys get compromised?

You only need one private key per device to be secure. The benefit of using separate keys per service is privacy - it prevents the various service providers from colluding to determine that you're a user of all the services (but if you're not careful you're probably leaking other information to them that would let them learn this anyways).


If you're not using passphrases on your keys, then yes they are locally wide open, much like a passwords.txt strategy for passwords. If you do passphrase them, the attacker now needs N passphrases. Perhaps you notice the keylogger before all passphrases get logged? There are probably more scenarios where N keys is strictly better than one, but that's the first that comes to mind.

I agree with the privacy aspect, it's that's the same point that the8472 made.


"perhaps you don't use password manager and you notice the keylogger halfway through" is a pretty unlikely scenario to motivate me to use a bunch of unique passphrases.

It's not "strictly better" when it hurts your ability to use and memorize strong passes.

Usability is part of security.


And unlike passwords the extra overhead of maintaining multiple keys is virtually frictionless.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: