alt Hacker NewsAbout to say, users just drop the key on their desktop and then download random exe's from the internet and run them.
Still safter in general, but not bulletproof.
About to say, users just drop the key on their desktop and then download random exe's from the internet and run them.
Still safter in general, but not bulletproof.
At least in that case, if the account is compromised we definitely didn't leak the credentials. That we don't have them to leak is one of the advantages of key-based auth.
[of course not having the credentials to leak does not protect us from this sort of bug, it is just one factor in a multipart security stance]