Re:Show HN: My SSH server knows who you are
by kevinastone on Tuesday August 04, 2015 @01:45PM
(#10004956)
It's a public key for a reason. You need to the private key to authenticate, so you're safe having everyone know your public key.
[ Parent
| on HN ]
Re:Show HN: My SSH server knows who you are
by RaleyField on Tuesday August 04, 2015 @04:54PM
(#10006226)
> It's a public key for a reason
It's public key because it's named such in the context of public key cryptography. But not all public keys should be available to public.
Ideally by default ssh client should use a different key pair for each server('s public key) it connects to. Some people want to hide their identity, for example Tox people chose to be anonymous, what SSH does goes against expectations so it has the ability to betray their choice.
Not only a different key-pair per server, but also per session.
It's fairly pointless of github to publish your public key though. Nobody can trust that it's actually yours.
Re:Show HN: My SSH server knows who you are
by chrisfosterelli on Tuesday August 04, 2015 @02:17PM
(#10005194)
If you trust your connection to Github and trust that the person in control of the account is the person the account represents, then why not trust that key?
Re:Show HN: My SSH server knows who you are
by the8472 on Tuesday August 04, 2015 @03:32PM
(#10005680)
> It's fairly pointless
If it enables security research it's already a win in my eyes.
Might expose classes of weak keys in the future for example.
Re:Show HN: My SSH server knows who you are
by chrisfosterelli on Tuesday August 04, 2015 @04:56PM
(#10006230)
Great point. That's already happened, and a lot of weak keys were found [0].
[0] https://blog.benjojo.co.uk/post/auditing-github-users-keys