Chris Green chris@areti.co.uk writes:
Richard Kettlewell wrote:
Something that nobody's yet mentioned (I think) that seems worth pointing out is that even with a passphrase-protected private key, an attacker who can run as your UID[1] can arrange to capture the passphrase next time you use it anyway.
That doesn't make passphrases useless, for instance they still defend against an attacker who can read your files but not run code under your UID.
[1] i.e. they don't even necessarily have to take control of the entire machine
Which again points down the line that says it's the physical machine security that really matters.
Sure, preventing unauthorized physical access is a part of security, but people running unauthorized code across the network is a rather important risk too at the moment.
Web browsers for instance appear to be far too complicated for anyone to get right. I suspect most of us don't run our web browsers and outgoing SSH sessions under distinct UIDs though.