Has anyone actually seen personal SSH or Git signing keys get stolen and used in attacks (not counting servers sitting on the internet with ssh open) ? It seems like the only really useful purpose for these tokens is as an MFA token, because passwords just suck. At the same time, it seems like long random bits that can't be remembered by humans just aren't so vulnerable that we need to carry around something to unlock them.
Maybe the issue is just that it's so easy to attack password-protected systems that nobody even needs to attack keys.
Maybe the issue is just that it's so easy to attack password-protected systems that nobody even needs to attack keys.