Re:We updated our RSA SSH host key
by faeriechangling on Friday March 24, 2023 @04:37AM
(#35286522)
While their reaction is more likely to cause a security breach, consider the psychology.
If the key was breached and Github just didn't know it, then a breach happened, then only Github would be to blame. If Github rotates its key, and somebody suffers a MITM attack, the blame is more diffuse. Why didn't you verify the key out of band?
If the key was breached and Github just didn't know it, then a breach happened, then only Github would be to blame. If Github rotates its key, and somebody suffers a MITM attack, the blame is more diffuse. Why didn't you verify the key out of band?