Raspberry Pi Z-Wave kit exposes private key

Re:Raspberry Pi Z-Wave kit exposes private key by ambrop7 on Friday February 20, 2015 @03:47AM (#9079572)

I see zero problem with using SSH, which happens to be a pretty secure protocol. In fact I would prefer it to HTTPS since it is not by default vulnerable to malicious CAs. Note for example that GitHub allows Git access over SSH.

When the author says that the system "exposes the private key", well, it's by design that the user can see it - since they need to use it to identify themselves to the SSH server. It's not much different from being assigned a password by the server. What could be improved is if it was transferred over HTTPS rather than HTTP, and of course also the install script.

(I only speak about the usage of SSH, it's possible that they still do something insecure..)

[ Parent | on HN ]

Re:Raspberry Pi Z-Wave kit exposes private key by lcampbell on Friday February 20, 2015 @03:56AM (#9079592)

> it is not by default vulnerable to malicious CAs

Well, in this particular case, they're using

  ssh [..] -o 'StrictHostKeyChecking no' -o 'UserKnownHostsFile /dev/null' [..]

So the remote authentication bits are already out the window. It would be nicer if they included the host's public key in the installation package rather than eschewing it completely.

[ Parent | on HN ]

Re:Raspberry Pi Z-Wave kit exposes private key by ambrop7 on Friday February 20, 2015 @03:58AM (#9079599)

Indeed, they're just using it wrong.

[ Parent | on HN ]

Re:Raspberry Pi Z-Wave kit exposes private key by lucaspiller on Friday February 20, 2015 @05:32AM (#9079842)

> When the author says that the system "exposes the private key"

To be fair the author didn't, the submitter did. I'm not sure if they are the same person.

[ Parent | on HN ]