News for hackers. Stuff that matters.

A comment on Show HN: Invite friends to SSH into your laptop using their GitHub handle. Parent comment

Re:Show HN: Invite friends to SSH into your laptop using the... by a3_nm on Wednesday January 25, 2017 @07:02PM (#13487449)
Of course, caveats about trusting Github also apply. (If Github got hacked, the page https://github.com/[github name].keys would serve the public key of a fresh attacker-controlled key and would trigger shortly afterwards an SSH login attempt with that key towards the client IP to do evil stuff.)
[ Parent | on HN ]
Re:Show HN: Invite friends to SSH into your laptop using the... by uiri on Wednesday January 25, 2017 @09:11PM (#13488157)
Not only GitHub but the specific user's account could be compromised through e.g. a weak or reused password.

In the general case, you should be fine. Even more so if the person whose GitHub account you are authorizing regularly checks their keys for suspicious activity.

[ Parent | on HN ]
Re:Show HN: Invite friends to SSH into your laptop using the... by ams6110 on Wednesday January 25, 2017 @10:03PM (#13488364)
You can (and should) verify the key fingerprint out of band.
[ Parent | on HN ]