Skip to content

Piotr Krakowski

← The Voice of the Proton Community

My feedback

2 results found

  1. SSH Agent

    781 votes

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close

    We’ll send you updates on this idea

    Under review  ·  111 comments  ·  Proton Pass & Authenticator » New feature  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close
    Piotr Krakowski supported this idea  · 
    An error occurred while saving the comment
    Piotr Krakowski commented  · 

    +1. One thing I would ask you to keep in scope while this is being analysed:
    key generation, not only storage and agent support.

    If the agent can serve keys from the vault but the keys still have to be
    created with ssh-keygen or PuTTYgen and imported afterwards, the private key
    touches the filesystem anyway, which is the exact thing this feature is meant
    to avoid. Generating Ed25519 inside Pass and never writing it to disk closes
    that gap.

    There is a separate idea for this ("ssh generate keys") with almost no votes,
    but the two only really make sense together.

  2. ssh generate keys

    5 votes

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close

    We’ll send you updates on this idea

    1 comment  ·  Proton Pass & Authenticator » New feature  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close
    An error occurred while saving the comment
    Piotr Krakowski commented  · 

    Details worth specifying, from someone who hands SSH keys to colleagues
    regularly:

    - Ed25519 by default, RSA 4096 as a fallback for servers older than
    OpenSSH 6.5.
    - Show the public key as a single copy-ready line in authorized_keys format.
    PuTTYgen's "Save public key" button writes RFC4716 instead, which OpenSSH
    rejects, and that one detail wastes a lot of people's time.
    - Export in both OpenSSH and PuTTY .ppk format. Windows clients (PuTTY,
    WinSCP, MobaXterm) still rely on .ppk.
    - Optional passphrase stored in the same item as the key.
    - Show the fingerprint in the item so it can be verified against the server.

    Combined with vault sharing this would also fix key handover inside a team,
    which today means sending a private key over chat or email.

    1Password and Bitwarden both ship SSH key items already, so there is a proven
    shape to follow.

    Piotr Krakowski supported this idea  ·