On: SSH keys stolen by stream of malicious PyPI and NPM packages

[fbdab103]

I must be missing something. If this novel key only exists inside my backups, it is not registered with any external services, and it cannot be used in the event the primary key is lost.

For me to register the backup-only key with other services, it would have to live on my machine, and be simultaneously registered in addition to the primary key. I am not sure what I am gaining vs having a backup of the primary key other than increased operational burden.

[vladvasiliu → fbdab103]

You can keep just the public part of the backup key on your current device and always enroll the two keys at a time.

But yeah, if the main device is stolen, it can be a pain to go update all the services with the new device’s key.

I personally use the gpg app on my youbikey for this, and the secret key comes from a backup I install on a livecd.

[fbdab103 → vladvasiliu]

Ah duh, keep the public part on the device.

However, that very quickly gets into the problem of untested backups. I am then relying completely upon a private key which has never been validated to work.