We updated our RSA SSH host key

Re:We updated our RSA SSH host key by edp on Friday March 24, 2023 @03:16AM (#35286011)

The fact that users have to delete the old Github key from their systems and accept a new one is what could lead to a MITM attack.

If your system doesn't know the public key of an SSH server, when you connect the first time, the SSH client will display a warning and ask you if you accept the server key. An attacker could be between you and Github and if you accept without checking it's the correct key, you would be toast.

[ Parent | on HN ]

Re:We updated our RSA SSH host key by pbhjpbhj on Friday March 24, 2023 @05:56AM (#35287023)

Would it be more secure to access a https secured server to get the keyfile then?

[ Parent | on HN ]

Re:We updated our RSA SSH host key by tialaramex on Friday March 24, 2023 @09:59AM (#35289157)

Yes, GitHub's announcement provides the correct new public RSA key, and it also provides instructions for a curl invocation which does all the work if you don't trust yourself to copy-paste text or don't understand how.

[ Parent | on HN ]

Re:We updated our RSA SSH host key by dheera on Friday March 24, 2023 @12:38PM (#35291656)

Only if the https server cert wasn't compromised at the same time as the ssh key.

[ Parent | on HN ]