News for hackers. Stuff that matters.

A comment on Show HN: My SSH server knows who you are.

Re:Show HN: My SSH server knows who you are by yesco on Tuesday August 04, 2015 @01:44PM (#10004947)
Forgive me ignorance here but what steps should I take to avoid someone from getting my public key off github and then using it to screw with my repos? Was there a major step I missed here when I made these keys?
[ Parent | on HN ]
Re:Show HN: My SSH server knows who you are by kevinastone on Tuesday August 04, 2015 @01:45PM (#10004956)
It's a public key for a reason. You need to the private key to authenticate, so you're safe having everyone know your public key.
[ Parent | on HN ]
Re:Show HN: My SSH server knows who you are by RaleyField on Tuesday August 04, 2015 @04:54PM (#10006226)
> It's a public key for a reason

It's public key because it's named such in the context of public key cryptography. But not all public keys should be available to public.

Ideally by default ssh client should use a different key pair for each server('s public key) it connects to. Some people want to hide their identity, for example Tox people chose to be anonymous, what SSH does goes against expectations so it has the ability to betray their choice.

[ Parent | on HN ]
Re:Show HN: My SSH server knows who you are by eru on Tuesday August 04, 2015 @09:58PM (#10007637)
Not only a different key-pair per server, but also per session.
[ Parent | on HN ]
Re:Show HN: My SSH server knows who you are by nly on Tuesday August 04, 2015 @02:14PM (#10005173)
It's fairly pointless of github to publish your public key though. Nobody can trust that it's actually yours.
[ Parent | on HN ]
Re:Show HN: My SSH server knows who you are by chrisfosterelli on Tuesday August 04, 2015 @02:17PM (#10005194)
If you trust your connection to Github and trust that the person in control of the account is the person the account represents, then why not trust that key?
[ Parent | on HN ]
Re:Show HN: My SSH server knows who you are by the8472 on Tuesday August 04, 2015 @03:32PM (#10005680)
> It's fairly pointless

If it enables security research it's already a win in my eyes.

Might expose classes of weak keys in the future for example.

[ Parent | on HN ]
Re:Show HN: My SSH server knows who you are by chrisfosterelli on Tuesday August 04, 2015 @04:56PM (#10006230)
Great point. That's already happened, and a lot of weak keys were found [0].

[0] https://blog.benjojo.co.uk/post/auditing-github-users-keys

[ Parent | on HN ]
Re:Show HN: My SSH server knows who you are by publysher on Tuesday August 04, 2015 @01:45PM (#10004959)
No, in order to mess with your repo, an attacker would need your private key. Github only publishes public keys. For more information you can check out https://en.wikipedia.org/wiki/Public-key_cryptography
[ Parent | on HN ]
Re:Show HN: My SSH server knows who you are by karlshea on Tuesday August 04, 2015 @01:48PM (#10004977)
GitHub doesn't even have your private key.
[ Parent | on HN ]
Re:Show HN: My SSH server knows who you are by yesco on Tuesday August 04, 2015 @01:52PM (#10005020)
Oh yea, duh. Thanks for clearing that up for me, I get the two mixed up a lot. (which is bad)
[ Parent | on HN ]
Re:Show HN: My SSH server knows who you are by shmerl on Tuesday August 04, 2015 @02:03PM (#10005108)
To make it easier. Your public key is something others would place on their servers to grant you access, and you'll need to have your private key to authenticate.
[ Parent | on HN ]