Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite
1

I often have to use computers other than my own while at work, and it would be convenient to fire up pagent with my private key. Is it OK to put my passworded private key in a semi-trusted space?

share|improve this question

3 Answers

up vote 3 down vote accepted

It depends on the systems that this private key gives access to. If it is only to your systems at home, and it only contains your family pictures, not a big deal. But if it protects a corporate firewall, or banking information, I would not.

The SSH keypairs are used to provide a two-factor authentication. There is something you know (the password) and something you have (the SSH private key). If you no more have the exclusivity of an SSH key, or do not control its use, you are infact removing of of the authentication factor.

I'm a bit crazy, but one of my SSH keys is stored on a fingerprint-protected device. With other security measures around this so that the private key is not left on temporary files, etc.

My point is that your private key may be safe for now. But if a bug is found in SSH key-generation algorithm, or if someone gets a copy and use brute-force to find its password, you increase the cahnces of getting hacked. Again, it depends on what you are protecting with your SSH key.

share|improve this answer
up vote 1 down vote

From a pure "paranoia with security" perspective, it is NOT ok. Many companies install software on their corporate PCs which are capabale of monitoring everything on those PCs, including keystrokes. (For example, look at this software: Digital Guardian )

In theory, they are able to capture your "password" that is protecting the private key.

In reality, these extreme features (such as key loggers and screen captures) may actually be disabled in most companies.

I am sorry, but whether or not you should have your password protected private key on someone else's PC is a question with subjective answer -- the answer is it depends on your level of paranoia.

share|improve this answer
I believe if a company is doing any kind of monitoring, it has to warn its employers about it. For example, if a company has webcams in the server room, warning the new hired sysadmin about it is a good way to prevent him being filmed while dancing naked in the server room :) It's the same about passwords. If a company is doing keylogging, it risks its own security, because keyloggers might use weaker techniques (because spying is often being done at the expense of stepping into some security pitfall) to store the captured data. – vtest Jul 20 '10 at 18:12
Sorry I should have been clear. When I said "many companies", I was referring to companies based in United States. In USA, it is perfectly legal for companies to monitor what employees do on work equipment during work hours. In addition, many companies (mine included) make you sign an agreement which basically says that you are aware of this policy. In other countries (for instance in many countries in Europe), I have heard that such monitoring practices may actually be illegal. – joyjit Jul 20 '10 at 19:05
In most countries in Europe is is perfectly legal for companies to monitor anything on their assets. They will need to state this in their usage policy, but it could well be hidden deep in small print. – Rory Alsop Dec 8 '10 at 23:36
up vote 0 down vote

It shouldn't really be down to paranoia - as your key is effectively 'you' on IT systems (as there is not a 100% guaranteed way to prove the person who typed something was you, this is often considered as close as you can get in general systems) so if you don't protect it someone else could be you to whatever level required.

Do you want to have to defend against technically 'provable' evidence that you committed an act?

Are you happy with knowing that you effectively have no confidentiality?

Protect your private key - always!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.