Recently, a developer proposed storing SSH private keys directly in the .git directory of a Git repository to achieve USB portability. This method claims to enable seamless migration of Git repositories between different devices without reconfiguring SSH keys. However, this suggestion has sparked intense security controversy within the developer community. Multiple security experts warn that storing private keys on removable devices poses significant security risks—if the USB device is lost or stolen, attackers could gain complete access to the Git repository. Comments provided various more secure alternatives, including using secure enclaves, adding password protection to keys, configuring multiple SSH keys, and using SSH configuration files. Although this solution does address the convenience of using Git repositories across multiple devices, developers generally agree that its security risks far outweigh its convenience benefits.
