Re:An SSH server that knows who you are
by luckycharms810 on Monday February 17, 2020 @12:29AM
(#22345798)
Well specifically it is sharing the public keys that you have in your SSH folder. It's like trying all your keys in a a keyhole since you don't know which one gets you in. This is really no fault of SSH - the fault lies completely with Github for sharing all their users' public SSH keys.
[ Parent
| on HN ]
Re:An SSH server that knows who you are
by saagarjha on Monday February 17, 2020 @12:41AM
(#22345833)
…but they're public keys.
Re:An SSH server that knows who you are
by meddlepal on Monday February 17, 2020 @01:07AM
(#22345906)
This. Exactly what are we afraid of here? It's working as designed.
Re:An SSH server that knows who you are
by ben0x539 on Monday February 17, 2020 @01:32AM
(#22345979)
It's not directly a security problem as in your computer is gonna get hacked, but it can ruin your opsec if you don't want people to realize that you're the person controlling a specific key.
Re:An SSH server that knows who you are
by meddlepal on Monday February 17, 2020 @02:31AM
(#22346160)
I would hope if you're doing serious opsec you're using ephemeral keys or isolated virtual environments for various endeavors.
Re:An SSH server that knows who you are
by exabrial on Monday February 17, 2020 @10:23PM
(#22353188)
Yep. I would also hope if you're 'doing opsec' you would know how your tools work.
Re:An SSH server that knows who you are
by luckycharms810 on Monday February 17, 2020 @09:25AM
(#22347878)
You are definitely right in that the public keys themselves don’t present a threat. I think on a penetration test this would show up as “Information Revealed” rather than something that is “Exploitable”. By sharing a username - you might be able to correlate this person to other platforms and technically increase your attack surface area.