News for hackers. Stuff that matters.

A comment on tilde.town: A social network over SSH.

Re:tilde.town: A social network over SSH by justaj on Friday August 28, 2020 @07:34AM (#24303656)
I'm always wary of using SSH services which aren't running on systems I control. If I'm not mistaken, an SSH service is able to see all of the pubkeys you have in your ~/.ssh/, so there goes your privacy.
[ Parent | on HN ]
Re:tilde.town: A social network over SSH by soraminazuki on Friday August 28, 2020 @08:29AM (#24304047)
I believe you could use SSH config files to restrict which keys that each host would be able to see.

Something along the lines of:

    Host a.example
      IdentityFile ~/.ssh/id_a
      IdentitiesOnly yes
[ Parent | on HN ]
Re:tilde.town: A social network over SSH by a3y3 on Friday August 28, 2020 @08:11AM (#24303913)
But they were public keys, it's completely fine if the entire world sees them
[ Parent | on HN ]
Re:tilde.town: A social network over SSH by soraminazuki on Friday August 28, 2020 @08:23AM (#24304000)
Perhaps the parent commenter is worried of public keys being used as a tracking vector?
[ Parent | on HN ]
Re:tilde.town: A social network over SSH by phre4k on Friday August 28, 2020 @09:00AM (#24304318)
Then they should create one key per service and only use that one.
[ Parent | on HN ]
Re:tilde.town: A social network over SSH by alexeldeib on Friday August 28, 2020 @11:17AM (#24305864)
Which they've done from the sound of it, and are concerned about the ability to read those other public keys and use them as a tracking vector.
[ Parent | on HN ]
Re:tilde.town: A social network over SSH by boring_twenties on Friday August 28, 2020 @02:19PM (#24308268)
As another commenter already pointed out, the IdentitiesOnly config option removes that ability. The ssh-config man page explains this.
[ Parent | on HN ]
Re:tilde.town: A social network over SSH by myself248 on Friday August 28, 2020 @02:43PM (#24308518)
Out of curiosity, are there reasons that that behavior shouldn't be the default?
[ Parent | on HN ]
Re:tilde.town: A social network over SSH by soraminazuki on Friday August 28, 2020 @09:53PM (#24312600)
I can think of three reasons:

1. It would stop SSH agent forwarding from working if the remote has it enabled.

2. It would stop alternative SSH agent implementations from working.

3. It would only make sense if you actually have multiple identities.

[ Parent | on HN ]
Re:tilde.town: A social network over SSH by boring_twenties on Friday August 28, 2020 @03:04PM (#24308751)
I'm not sure it makes much sense unless you also override the default IdentifyFile.
[ Parent | on HN ]
Re:tilde.town: A social network over SSH by boring_twenties on Friday August 28, 2020 @11:36PM (#24313212)
Argh, IdentityFile.

I make the same damn mistake in my actual config file, too.

[ Parent | on HN ]
Re:tilde.town: A social network over SSH by staffordrj on Friday August 28, 2020 @11:21AM (#24305915)
I recently discovered github publishes any of your registered ssh public keys at https://github.com/username.keys
[ Parent | on HN ]