Charm – Tools to make the command line glamorous

Re:Charm – Tools to make the command line glamorous by matthewaveryusa on Sunday January 23, 2022 @04:15PM (#30050505)

You potentially send all your key IDs (ie public keys) your agent has. there are command line options to force your ssh not to use your agent in which case, barred any bugs in the ssh client, it’s like browsing to a domain in your browser.

[ Parent | on HN ]

Re:Charm – Tools to make the command line glamorous by jdavis703 on Sunday January 23, 2022 @09:13PM (#30052880)

This is the first time I’ve heard someone say sharing public keys is a security risk. Can you explain the threat model here?

[ Parent | on HN ]

Re:Charm – Tools to make the command line glamorous by wtetzner on Sunday January 23, 2022 @09:50PM (#30053155)

I think it’s more of a privacy leak. E.g., the service could potentially figure out who you are if your public keys are tied to some other service, like GitHub.

[ Parent | on HN ]

Re:Charm – Tools to make the command line glamorous by ragona on Sunday January 23, 2022 @09:40PM (#30053088)

If you ever manage to leak a private key it’s easier to track it back to you. There was a recent paper showing the ability to tie rather a lot of keys to the associated developers.

[ Parent | on HN ]

Re:Charm – Tools to make the command line glamorous by lenkite on Monday January 24, 2022 @04:15AM (#30055125)

Would be easy to contact other web services and determine the identity marching a public key.

[ Parent | on HN ]