Re: ssh help

Shawn Bayern (shawn.bayern@yale.edu)
Sun, 8 Nov 1998 20:58:10 -0500 (EST)

On Sun, 8 Nov 1998, Michael Bernstein wrote:

> > As I've already described, this is inadvisable.
>
> I'm curious; why do you consider this inadvisable? Even if someone
> steals my public identity, they cannot login anywhere else as me.

I'm just recommending against using RSA-based authentication to "log in to
the pantheon w/o a password," as Collin wants to do. That implies that
he's not using a passphrase to protect his *private* key; if trusted,
storing this private key without a passphrase is equivalent to storing an
unencrypted password on disk.

I definitely have nothing against using RSA-based authentication in the
first place. But, as the SSH documentation strongly recommends, private
keys should be protected with passphrases.

Shawn