The poster of the fingerprints is in the middle, you are not getting them from GH if you use them instead of going to the linked page.

This is literally a man in the middle between you and GitHub.

If someone wanted to trick HN users into trusting a phoney key, one way to do that would be to post the phoney fingerprint on HN claiming it to be the real one.

And within a few seconds someone will have called this out in a reply

Assuming the person doesn’t have some back door access to HN as well.

Or they don't simply wait a while and edit it when it's not under high scrutiny.

You can only edit for a certain amount of time

And if someone would actually fall for this, they deserve to be fired, and/or never allowed anywhere near anything related to computer security. :)

I mean, yes, but you'd also have to have a way to actually MITM the person you are targeting via HN comment, before anyone pointed out it was wrong. It'd be much easier to just use the MITM you already have and not raise the suspicion of posting in a comment.

Don't overthink this.

Why downvote this person! The parent post left plenty of ambiguity in their comment. Are they saying that an actual MITM attack is happening? That the fingerprints shared are actually the wrong ones?

Generally speaking, one would not consider an internet comment directing folks to GitHub's actual SSH fingerprints a "man in the middle" as the phrase in this context usually has a negative implication, where in this case defanor is in fact simply mirroring the actual information that GitHub has officially posted in a way that is much more helpful than yetanotherjosh's "double check it is the expected value". For most of us idiots, we don't know what the expected value is!

So thank you defanor for sharing, and thank you darthrupert for asking for clarification. Y'all contributed to educating myself and others and now we know more because of it.

Ah, okay. I thought this was obvious that the keys in the comment were just for show, and if anyone would need the actual keys, they would be looked via the GH link anyway.

Good clarifications everywhere, yes.