Re: gEDA-dev: Switching to git -- getting write access

["Ales Hvezda" <ahvezda@xxxxxxxxx>]

> ssh public key is more secure than ssh with passwords, because nothing
> that passes over the internet or lives on remote machines is
> sufficient to give someone access to your priviledges.  Even if geda's
> git server is compromized, the public key therein isn't enough to gain
> access to other machines.

Okay fair enough, but what if the local machine (not the git server machine)
is compromised?  Wouldn't that mean that now my server is vulnerable because
the attacker has the private key?  Of course, they would need to know the
pass phrase assuming there is one (I've never created a public/private key
without a pass phrase).

>
> If you do ssh with password, that password has to exist on the remote
> server, which makes it available if the machine is compromized.

If the remote machine is compromised, I doubt they will care about a
password on some local account.  Please tell me people aren't using
the same password everywhere.

-Ales


_______________________________________________
geda-dev mailing list
geda-dev@xxxxxxxxxxxxxx
http://www.seul.org/cgi-bin/mailman/listinfo/geda-dev