News for hackers. Stuff that matters.

A comment on We updated our RSA SSH host key. Parent comment

Re:We updated our RSA SSH host key by cesarb on Friday March 24, 2023 @10:07AM (#35289239)
On the other hand, this is a nice TOFU-style double check. The first time HN user "defanor" went to that page, these were the fingerprints; if later someone somehow invades the github documentation server (or somehow MITMs your HTTPS connection to it), and changes the fingerprints there, they will no longer match the ones saved in the comment above.
[ Parent | on HN ]
Re:We updated our RSA SSH host key by NelsonMinar on Friday March 24, 2023 @11:28AM (#35290329)
Well, "defanor" says these were the fingerprints. Perhaps they are the MITM.

(Not genuinely concerned about this risk, but "Reflections on Trusting Trust" reverberates.)

[ Parent | on HN ]