Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was wondering, is it considered safe to use the same SSH key for multiple sites? (eg. github, bitbucket, heroku, etc)?

Or is it recommended to generate a different SSH key for each website/usage?

share|improve this question

migrated from stackoverflow.com Jun 13 '11 at 1:14

This question came from our site for professional and enthusiast programmers.

2 Answers 2

up vote 2 down vote accepted

You are only giving the public key to these sites. They can't do anything with this key, other than identifying that it is the same one. If you are concerned about your anonymity, use separate keys (and configure your ssh client to offer just one to each server, not all of them).

There is no risk of compromising your private key, as long as you use it correctly and don't let is leave your computer. Of course, if it is compromised somehow, it would compromise all your accounts there.

But the most probable scenario of compromising your key would be a trojan or similar on your computer, in this scenario all your other keys will be compromised as well. So using only one public key (per client computer) is enough here, too.

share|improve this answer

We use the same ssh keys on multiple sites but that's only because we control all the sites (as in a large number of company-controlled sites).

We wouldn't do so for sites that were controlled by third parties, since it has security implications.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.