GitHub and Gitlab exposes all user's public SSH keys (2019)

Posted by weastur on Wednesday April 06, 2022 @06:05PM
from the self-post dept.

Pretty unsafe, I think. And you can't turn it off. https://rushter.com/blog/public-ssh-keys/

Links to APIs:

https://docs.github.com/en/rest/reference/users#list-public-keys-for-a-user

https://docs.gitlab.com/ee/api/users.html#list-ssh-keys-for-user

( 3 comments | on HN )

Re:GitHub and Gitlab exposes all user's public SSH keys (2019) by dossy on Wednesday April 06, 2022 @06:09PM (#30938085)

By definition, the public key is _public_, there's no real risk in publishing them.

[ Parent | on HN ]

Re:GitHub and Gitlab exposes all user's public SSH keys (2019) by version_five on Wednesday April 06, 2022 @06:15PM (#30938145)

The article (2 years old) explains you could get someone's public keys from github and then compare them with other public keys (they mention on ssh servers) to see if a person is using the same key elsewhere.

The argument boils down to the fact that ssh will also give you a list of valid public keys.

It doesn't seem very critical to me, and anyone who is worried could just use a different key for github which is good practice anyway imo

[ Parent | on HN ]

Re:GitHub and Gitlab exposes all user's public SSH keys (2019) by miohtama on Wednesday April 06, 2022 @06:10PM (#30938097)

Public key, by definition, is public. Exposing something that’s public can do very little harm.

Here is more discussion:

https://security.stackexchange.com/questions/150540/is-it-co...

[ Parent | on HN ]