> Here's the fundamental problem. If you can't understand very basic security tools and concepts, you cannot securely operate a computer, much less hope to ever write secure code.
He didn't say he was incapable of understanding it.
> SSH is one of the easiest security tools to use safely that has ever existed. I would say it is second in usability only to HTTPS in browsers
Perhaps that's true, but I suggest testing it would show a massive discrepancy between ease of HTTPS use and SSH use.
In short: I think this is a UX issue, not a PEBCAK one.
There is no UX issue, it's entirely an irrational fear of having to read. Putting it in a GUI accomplishes nothing but clutter the screen with irrelevant crap.
nknight@unassigned-hostname:~$ ssh-keygen -t rsa -C "[email protected]"
Generating public/private rsa key pair.
Enter file in which to save the key (/home/nknight/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/nknight/.ssh/id_rsa.
Your public key has been saved in /home/nknight/.ssh/id_rsa.pub.
The key fingerprint is:
d3:c0:19:ae:5b:ff:46:fd:a0:b5:9c:a2:93:a4:ca:c2 [email protected]
The key's randomart image is:
+--[ RSA 2048]----+
| . |
| o o |
| = |
| . o |
| . S . . |
| o o. . + |
| . . o.o + = |
| E. . o.+ + .|
| .o. .+.. |
+-----------------+
nknight@unassigned-hostname:~$
Read. READ. Comprehend. Don't throw your hands up and say "But it's sooooo confusing!". It's not. It's very simple, and it is not possible to simplify further, no matter how you try to dress it up in eyecandy, you still must read and comprehend the exact same concepts. If you do not, you cannot be secure. Ever. The basic concepts of public key crypto are mandatory knowledge for everybody.
Get over your irrational fear and you will have no more trouble than you would reading a technical book.
That is an excellent example of "scary crypto stuff".
Most people aren't going to change where the file is saved, or care. They don't know, or care what a fingerprint is. I still have no idea what the 'randomart' images are about.
I don't see any benefit to all of that over having a button marked "make keys" which just gets me set up so I can use github.
Of course, you could force people to care about what files are placed where, and their permissions. Then you should probably remove the default values of course.
So long as you're unwilling to learn, very simple things will forever elude you.
> I don't see any benefit to all of that over having a button marked "make keys" which just gets me set up so I can use github.
It's not that the form has any strong benefit in itself, it's that if you understand what is going on, which is required for security, the text form is in no way mysterious, complicated, or intimidating. The GUI isn't fixing anything, it's just masking a serious problem with the user.
I also like being told where semi-automated processes are placing critical files on my filesystem. I'm surprised that annoys you.
> I also like being told where semi-automated processes are placing critical files on my filesystem. I'm surprised that annoys you.
No, it really doesn't annoy me. I'm very happy for you to use git from the command line. I use git from the command line and don't intend to use this new GUI. It would be no good to me anyway, as I use linux.
However, I get the feeling that you are annoyed that other people might want to have a full automated process, and not care where the critical files are being placed.
As time goes by I feel one of the most important things is to reduce the amount of work it takes for people to get started with something, particular because I have wasted so much time on it. Did I waste the time I spent getting started with git? vim? python? Not at all.
Did I waste the time I spent getting started with emacs? ruby on rails? mercurial? FreeBSD? Arch Linux? screen? To be honest yes. Each of these things, in their own way, had an annoying and non-user friendly setup and start, and I've since stopped using them and don't believe the skills were transferable. While I enjoy learning things, sometimes I just want to get started. Also, sometimes I want to get many collegues, who are less computer literate but still experts in their own fields, started.
GitHub for Windows generates and associates the key automatically without any user intervention. This is arguably better UX, and indicates that how to use ssh-keygen isn't necessarily mandatory knowledge.
All sorts of things can be done without any user intervention, but if the user doesn't understand how it works, they can't use it safely, and they are a danger to themselves and those around them.
One can perform the act of driving a car without any understanding of what the engine does, but if you lack any understanding of what it does, you're going to park it in a closed garage, leave it running, and kill yourself or someone else because you were too afraid of scary mechanical stuff to learn.
If you can't be bothered to learn about public key crypto, someone's going to social engineer your key out of you without you having any clue what happened.
It could use a "Key generated in `c:\users\james\.ssh\`. Don't share keys indiscriminately." dialog, but that's about it to achieve social engineering education parity with ssh-keygen. Users aren't inherently less secure just because they didn't copy and paste a command and see a randomart image.
He didn't say he was incapable of understanding it.
> SSH is one of the easiest security tools to use safely that has ever existed. I would say it is second in usability only to HTTPS in browsers
Perhaps that's true, but I suggest testing it would show a massive discrepancy between ease of HTTPS use and SSH use.
In short: I think this is a UX issue, not a PEBCAK one.