How I got over 300 Tor exit nodes removed

Could someone DDoS Tor by abusing exitmap ?

Depends what you mean by key and what you mean by affect. They can still MITM you if your using pubilc key authentication and you accept the servers host key without verifying it.

That depends on the VPS technology stack being used. IIRC, at least Amazon uses hardware features like IOMMU that prevent any kind of access to the guest's memory from the host side.

The thing is, that only helps Tor users who are happy for their PC to contain evidence of what they were doing over Tor (such as a known hosts file listing).

If your security requirements are so high your PC contains no evidence whatsoever of what you were doing over Tor, you wouldn't get the banner.

If anything, it's a miracle that there is 3000 of them. Although you can safely assume that a good portion of them (if not the majority) are operated by state intelligence services, cybersecurity companies and bad actor, who will log everything that pass through their node (and might be able to decrypt them one day).

Also depending on country you might be accused by aiding them, and it would be upon you to explain the court you have no control who uses the exit node nor their ID

[1] - https://ifconfig.me/

You have already sent the password to the mitm already.

I switched over to using that in Terminus recently instead of having Terminus generate and manage the private ssh keys.

Likewise, many Mac and MacBook machines have Secure Enclave too that can store private keys in hardware and works with the ssh client that comes with macOS. But I have not personally started using that yet. Will soon though. You then use TouchID to approve each login operation that ssh is performing.

Yubikey is cool too. I’ve used it mainly for other things than ssh.

Whatever solution you go with, have a backup or another way to restore access when your hardware key eventually breaks and cannot be used.

For example, instead of buying one Yubikey buy three and give each of them access to the same places. Keep one on you, one at home, and one somewhere else. Rotate between using each of them every couple of weeks so you are sure they all still work and that all of them have the accesses to all the same places.

In the case of ssh, you probably either have physical access to the target machine or you have VNC management from the hosting provider, etc, that you can fall back to if you misplace or damage your hardware key. So if you only use the hardware key for ssh and you have other means like those to get back in then having just a single hardware key is mostly fine.

Reputable vendors of those hardware keys included Yubikey and Token2, among others. You are really just using them as FIDO2 tokens, so go for what's reputable there.

If you are just getting started, you can generate and use software-backed keys (using ssh-keygen) and copy the public keys to servers' authorized_keys file using ssh-copy-id (or manually adding it). You should probably start learning this way (with plenty of online guides, and fewer risks of an old server implementation not supporting FIDO2 credentials), and then move to hardware keys once you understand the mechanics of copying around public keys, etc. Your password manager might also support acting as an SSH agent for key based logins - I believe Bitwarden and some others now do this, for example.

Yubikey benefits is it stores the keys in the hardware if your laptop is compromised somehow or stolen they at least don't get all the ssh keys too

Wrote up the cleanup: isolate the clanker, retire the leftovers, move admin logins to a hardware key with touch and PIN. https://gist.github.com/AUAggy/c1881c1efd85b6cc46d3564ac9012...

If you are on a compatible Apple MacBook you can also use Touch-ID https://news.ycombinator.com/item?id=50175882