An SSH server that knows who you are

Re:An SSH server that knows who you are by untog on Monday February 17, 2020 @12:11AM (#22345750)

I really don’t think there’s anything obvious about the fact that logging into an SSH server also exposes other login information stored in your computer. Given that creating a Github account is one of the first things beginner devs are guided towards it’s worth keeping such beginners in mind.

And it’s not so much “places you’re not supposed to” as “places you know haven’t been compromised in any way”, which is difficult to know unless you’re the sysadmin.

[ Parent | on HN ]

Re:An SSH server that knows who you are by exabrial on Monday February 17, 2020 @07:02AM (#22347076)

The fact that people are using this tool regularly and fail to grep a basic understanding of what and how the protocol works in mind blowing.

[ Parent | on HN ]

Re:An SSH server that knows who you are by untog on Monday February 17, 2020 @08:23AM (#22347469)

Is it really? It’s what Github recommends for every new user without explaining in real depth what’s going on.

[ Parent | on HN ]

Re:An SSH server that knows who you are by raggi on Monday February 17, 2020 @03:11AM (#22346260)

For example there was an RCE in iTerm2 in October, whenever tmux integration is turned on (https://nvd.nist.gov/vuln/detail/CVE-2019-9535). It's unlikely you have a good reason to believe your terminal stack is secure.

[ Parent | on HN ]

Re:An SSH server that knows who you are by luckycharms810 on Monday February 17, 2020 @12:29AM (#22345798)

Well specifically it is sharing the public keys that you have in your SSH folder. It's like trying all your keys in a a keyhole since you don't know which one gets you in. This is really no fault of SSH - the fault lies completely with Github for sharing all their users' public SSH keys.

[ Parent | on HN ]

Re:An SSH server that knows who you are by saagarjha on Monday February 17, 2020 @12:41AM (#22345833)

…but they're public keys.

[ Parent | on HN ]

Re:An SSH server that knows who you are by meddlepal on Monday February 17, 2020 @01:07AM (#22345906)

This. Exactly what are we afraid of here? It's working as designed.

[ Parent | on HN ]

Re:An SSH server that knows who you are by ben0x539 on Monday February 17, 2020 @01:32AM (#22345979)

It's not directly a security problem as in your computer is gonna get hacked, but it can ruin your opsec if you don't want people to realize that you're the person controlling a specific key.

[ Parent | on HN ]

Re:An SSH server that knows who you are by meddlepal on Monday February 17, 2020 @02:31AM (#22346160)

I would hope if you're doing serious opsec you're using ephemeral keys or isolated virtual environments for various endeavors.

[ Parent | on HN ]

Re:An SSH server that knows who you are by exabrial on Monday February 17, 2020 @10:23PM (#22353188)

Yep. I would also hope if you're 'doing opsec' you would know how your tools work.

[ Parent | on HN ]

Re:An SSH server that knows who you are by luckycharms810 on Monday February 17, 2020 @09:25AM (#22347878)

You are definitely right in that the public keys themselves don’t present a threat. I think on a penetration test this would show up as “Information Revealed” rather than something that is “Exploitable”. By sharing a username - you might be able to correlate this person to other platforms and technically increase your attack surface area.

[ Parent | on HN ]