News for hackers. Stuff that matters.

A comment on Keybase is not softer than TOFU. Parent comment

Re:Keybase is not softer than TOFU by swiftcoder on Wednesday March 27, 2019 @06:11PM (#19506669)
SSH is even worse in many corporate environments, because you also have to cross an SSH gateway to transit into from the corp fabric into the prod fabric.

At AWS this meant we had to hop to a different gateway for each region, and then onto the (stateless) production host which was recreated from scratch on every deployment... There's no way a human was going to keep all those keys straight, and everyone just disabled SSH host verification.

[ Parent | on HN ]
Re:Keybase is not softer than TOFU by rocqua on Wednesday March 27, 2019 @06:27PM (#19506809)
This actually seems like the right use-case for SSHFP records. They allow for storing the SSH key fingerprint in a DNSSEC secured zone.

Normally this is considered rather weak, because of the reliance on DNSSEC. However, in this case I think its a very easy to take step that'll be miles better than just trusting everything.

The stronger alternative is Certificate-based SSH, but that is a lot of hassle. As it requires setting up a CA, handling revocation, and actually distributing the certificates.

[ Parent | on HN ]
Re:Keybase is not softer than TOFU by toast0 on Thursday March 28, 2019 @01:58AM (#19509648)
It depends on how transient your servers are, but you can get pretty good mileage out of a checked in known_hosts file.
[ Parent | on HN ]