Re: [gentoo-dev] disabling password authentication on dev.gentoo.org

[Hallgrimur H. Gunnarsson]

AB> I am not sure its a good Idea, I work on Gentoo from home and from school
AB> uploading and downloading files all the time, the computers at school are
AB> public and I can't put my key in there (If I forget to logout or
AB> something).

HHG> If you're going to trust a public school computer with your password in
HHG> the first place, you might just as well put your key there too. However,
HHG> should you trust a public school computer with your gentoo access at
HHG> all?
 
AB> Can you please explain whats wrong with using my password?

I never said there was something wrong with using your password. 

You said that your reason for not using a key is that you don't want
to put the key on a public school computer. The fact that you don't
want to put it there suggests to me that you don't trust that particular
computer. Why would you trust a computer with your password but not
your key?

The only way your key will be compromised is if the computer itself
were to be compromised, and a compromised computer will give the attacker
your gentoo access, no matter what authentication mechanism you're using.

So my remark was, you put the same amount of trust in that computer
whether you're using a password or a key. Either you trust it or you
don't, and should you put your trust in a public school computer?

-- hhg

--
gentoo-dev@g.o mailing list