1

If I do not set a passphrase for the SSH Key generation what risks do I run?

From what I understand the only risk of someone gaining access would be if the laptop was stolen and therefor have the SSH Key on it.

Is this correct?

Improve this question

1 Answer 1

Reset to default
2

That is correct. With an un-protected private key, you'd need to remove the public key from github and wherever else it's present ASAP to revoke access.

As a good practice, though, I always recommend encrypting the private key with a passphrase. With ssh-agent (on Linux/OSX) or pageant (windows), there's very little pain involved in using an encrypted key.

Improve this answer
8
  • I am scripting git commands on windows machines and have had no luck with setting up pagent or connecting over https. Every time it asks me for a password. Which I could have my script enter it but I would rather not/
    – chronoz
    Feb 21, 2012 at 20:58
  • Fair enough. If you're having problems connecting with git, you ought to post another question, though.
    – EEAA
    Feb 21, 2012 at 21:01
  • But would you say overall very little risk is present? We are using git for content revision and not code revision. The repos will be backed up and any data that is in the repos is on the laptops as well.
    – chronoz
    Feb 21, 2012 at 21:04
  • Use a passphrase protected key on systems which could be stolen/compromised, and an exposed key on properly secured servers. That's what I do.
    – Kyle Smith
    Feb 21, 2012 at 21:10
  • What @KyleSmith said. Very good advice.
    – EEAA
    Feb 21, 2012 at 21:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .