He's embarrassed that he couldn't find a trivial XSS in an extremely popular website on his first try.

Hello! I have a (likely noobish) question about ssh private keys. I'm kindof new to ssh key usage and so I'm reading about it. I read somewhere that a "good (secure) practice" was to generate the private/public key pair, add the private key to the ssh-agent, copy the private key to a removable device like an usb drive, then delete the key from the ~/.ssh directory.

Does this practice mean that the next time I log into my Windows computer, I'll need to plug-in the USB device, then call the agent like this: ssh-add d:\path\to\the\private-key\on\the\USB\device\key-file?

(If that's considered software support, then feel free to ignore :))

@Vaillancourt That advice is non-standard tbh. I believe I can speak for most users of SSH and say that the ~/.ssh/ folder is the default place for storing both pub and priv keys. If you are worried about someone messing with your priv key putting it on a thumbdrive is one way of securing it but it is fairly non-standard. A better way would be to just leave it in the ~/.ssh/ folder and password protecting the SSH key (usually the option is given while generating it).

Password protecting a SSH key is more of a standard practice and most likely more secure than moving it to a thumbdrive.

All right, thanks!

Ah, also, is the private key "important" i.e. should I backup the file in case my computer goes boom?

@Vaillancourt that's all relative to what your doing w/ it. I use my SSH key to log into my cloud servers and access servers for work ... worst case if I loose mine I can gen a new one and update it. However a pub/priv key pair can also be used for signing and/or encrypting messages.

If for example someone uses your pub key to encrypt a message to you in the event that they die ... it could in theory be catostrophic if you loose the priv key. Another example would be if you loose your priv key for crypto assets.'

I personally do not back mine up as all the cases where I do use it I have a secondary way in to update them ... but ymmv

@Vaillancourt For an SSH private key, it's important if you have no other way of logging in to the system.