Re:Encrypted copies of Bitbucket SSH keys leaked
by necovek on Friday June 30, 2023 @02:44AM
(#36531358)
Another point worth bringing up: it'd be nice if we set up either a PGP-like trust ring for host SSH signatures, or relied on a set of CAs like we do for TLS.
Something as simple as confirm-fingerprint-over-https (eg. look for https://ssh-host/.host-ssh-fingerprint) could work if enough ssh clients used it.
Re:Encrypted copies of Bitbucket SSH keys leaked
by dentarg on Thursday July 06, 2023 @04:17AM
(#36612839)
You can do that with DNS (preferably DNSSEC is used): https://en.wikipedia.org/wiki/SSHFP_record, https://man.openbsd.org/ssh_config#VerifyHostKeyDNS
However, it seems to be about their host keys. The article seems down for me, but https://bitbucket.org/blog/ has a title "ACTION REQUIRED: Update your Bitbucket Cloud SSH Host Keys".
That means that you need to drop their entries from your known_hosts file or you risk a MITM attack on an insecure network.
Considering we usually blindly accept new SSH hosts without checking for fingerprints (eg on new or reinstalled machines), it's probably unlikely this will be exploited in the wild since it already could have been.