Sign arbitrary data with your SSH keys

Re:Sign arbitrary data with your SSH keys by andylynch on Saturday November 13, 2021 @09:05AM (#29209781)

You can go long way with an anonymous gmail address (this is what whoever from GCHQ do on their open source GitHub stuff)

[ Parent | on HN ]

Re:Sign arbitrary data with your SSH keys by numair on Saturday November 13, 2021 @09:21AM (#29209904)

You know, if I was 17 and bored, I’d look up all of the keys for all of the people from national security agencies that have contributed to open source projects on GitHub and see if anything noteworthy turns up anywhere.

[ Parent | on HN ]

Re:Sign arbitrary data with your SSH keys by lou1306 on Saturday November 13, 2021 @11:14AM (#29210788)

Somewhat related: a friend of mine crawled across a ton of publicly available PDFs from several security agencies and found a lot of interesting metadata about their setup (stuff like OS version, word processor of choice, even the author's names in some cases).

https://therecord.media/security-agencies-leak-sensitive-dat...

[ Parent | on HN ]

Re:Sign arbitrary data with your SSH keys by semiquaver on Saturday November 13, 2021 @11:10AM (#29210762)

What you describe isn’t possible since commits are not associated publicly with SSH keys in any way.

[ Parent | on HN ]

Re:Sign arbitrary data with your SSH keys by gpm on Saturday November 13, 2021 @11:21AM (#29210864)

They are if you sign them...

[ Parent | on HN ]

Re:Sign arbitrary data with your SSH keys by larusso on Saturday November 13, 2021 @01:06PM (#29211816)

you mean gpg sign? By the way the gpg public keys are also available via a URL. https://github.com/Larusso.gpg

Edit If course you mean the new signing feature which will come to git and GitHub in the future. Sorry

[ Parent | on HN ]

Re:Sign arbitrary data with your SSH keys by gpm on Saturday November 13, 2021 @03:43PM (#29213013)

You're entirely right, just a brain fart on my part that those are different keys. Not sure why you're downvoted.

[ Parent | on HN ]