Hacker News Reader

> This doesn’t actually pose much additional security risk because by hypothesis anyone who can read this file has read access to your current private ssh keys already.

Yes, but they don't have access to my password. That's kind of the point. Having a password-protected private key file is much less useful without the password. If you're going to store the password, might as well just remove it and save yourself the trouble.

View on HN

I read it like you the first time but now I think he means the remote account password. As if I have password auth enabled in sshd.

But he talks about GPG directories. And then says he uses drive encryption... To protect his passwords? No, these sentences don't make sense.

To protect all the files on his computer(s), including the public/private key pairs that allow him access to remote machines.

I feel like I'm stating the obvious so perhaps I'm missing something, but FDE only protects anything when a computer is off or a volume is otherwise not mounted.

Eg. your average shoulder surfing/xscreensaver unlock bypassing jerk, hacker or piece of malware isn't going to bother checking if an already mounted filesystem happens to be on an encrypted block device and voluntarily decide not to copy all your private keyfiles.

Reply on news.ycombinator.com