News for hackers. Stuff that matters.

A comment on Encrypted copies of Bitbucket SSH keys leaked. Parent comment

Re:Encrypted copies of Bitbucket SSH keys leaked by necovek on Friday June 30, 2023 @02:44AM (#36531358)
Another point worth bringing up: it'd be nice if we set up either a PGP-like trust ring for host SSH signatures, or relied on a set of CAs like we do for TLS.

Something as simple as confirm-fingerprint-over-https (eg. look for https://ssh-host/.host-ssh-fingerprint) could work if enough ssh clients used it.

[ Parent | on HN ]
Re:Encrypted copies of Bitbucket SSH keys leaked by dentarg on Thursday July 06, 2023 @04:17AM (#36612839)
You can do that with DNS (preferably DNSSEC is used): https://en.wikipedia.org/wiki/SSHFP_record, https://man.openbsd.org/ssh_config#VerifyHostKeyDNS
[ Parent | on HN ]