Show HN: Keypub.sh – OAuth for the terminal using SSH keys

Re:Show HN: Keypub.sh – OAuth for the terminal using SSH keys by jclulow on Monday December 23, 2024 @01:20PM (#42496432)

Care should always be taken when using an SSH client to connect to untrusted hosts. Make sure you’re not actually forwarding your SSH agent to the remote host, or they’ll be able to hijack your keys. Consider also that any output is processed by your terminal, and there have been a number of serious security bugs in terminal escape sequence handling in a variety of terminal emulators in the past.

[ Parent | on HN ]

Re:Show HN: Keypub.sh – OAuth for the terminal using SSH keys by bityard on Monday December 23, 2024 @03:30PM (#42497348)

"Hijack your keys" is somewhat overstating it, all they can do with it is log into other hosts that you can log into, assuming key auth is the only factor. And only while you are connected to the original host.

Terminal security bugs are not more or less serious than your average Chrome 0day.

[ Parent | on HN ]

Re:Show HN: Keypub.sh – OAuth for the terminal using SSH keys by wkat4242 on Monday December 23, 2024 @09:29PM (#42499230)

My yubikey always requires a physical touch so even if the agent is forwarded my keys can't be used. And I'll notice when it tries because I see it flashing.

[ Parent | on HN ]

Re:Show HN: Keypub.sh – OAuth for the terminal using SSH keys by rfdonnelly on Tuesday December 24, 2024 @11:01AM (#42502745)

Best to use an agent that prompts you for signing. 1Password and Yubikey do this. Are there others?

[ Parent | on HN ]