4 ms·

Forgive me ignorance here but what steps should I take to avoid someone from getting my public key off github and then using it to screw with my repos? Was ther

by yesco 11y ago

Forgive me ignorance here but what steps should I take to avoid someone from getting my public key off github and then using it to screw with my repos? Was there a major step I missed here when I made these keys?

kevinastone 11y ago
It's a public key for a reason. You need to the private key to authenticate, so you're safe having everyone know your public key.
- nly 11y ago
  It's fairly pointless of github to publish your public key though. Nobody can trust that it's actually yours.
  - chrisfosterelli 11y ago
    If you trust your connection to Github and trust that the person in control of the account is the person the account represents, then why not trust that key?
  - the8472 11y ago
    > It's fairly pointless If it enables security research it's already a win in my eyes. Might expose classes of weak keys in the future for example.
    - chrisfosterelli 11y ago
      Great point. That's already happened, and a lot of weak keys were found [0]. [0] https://blog.benjojo.co.uk/post/auditing-github-users-keys https://blog.benjojo.co.uk/post/auditing-github-users-keys
- RaleyField 11y ago
  > It's a public key for a reason It's public key because it's named such in the context of public key cryptography. But not all public keys should be available to public. Ideally by default ssh client should use a different key pair for each server('s public key) it connects to. Some people want to hide their identity, for example Tox people chose to be anonymous, what SSH does goes against expectations so it has the ability to betray their choice.
  - eru 11y ago
    Not only a different key-pair per server, but also per session.
publysher 11y ago
No, in order to mess with your repo, an attacker would need your private key. Github only publishes public keys. For more information you can check out https://en.wikipedia.org/wiki/Public-key_cryptography https://en.wikipedia.org/wiki/Public-key_cryptography
- karlshea 11y ago
  GitHub doesn't even have your private key.
- yesco 11y ago
  Oh yea, duh. Thanks for clearing that up for me, I get the two mixed up a lot. (which is bad)
shmerl 11y ago
To make it easier. Your public key is something others would place on their servers to grant you access, and you'll need to have your private key to authenticate.

by yesco 11y ago

kevinastone 11y ago

It's a public key for a reason. You need to the private key to authenticate, so you're safe having everyone know your public key.

nly 11y ago
It's fairly pointless of github to publish your public key though. Nobody can trust that it's actually yours.
- chrisfosterelli 11y ago
  If you trust your connection to Github and trust that the person in control of the account is the person the account represents, then why not trust that key?
- the8472 11y ago
  > It's fairly pointless If it enables security research it's already a win in my eyes. Might expose classes of weak keys in the future for example.
  - chrisfosterelli 11y ago
    Great point. That's already happened, and a lot of weak keys were found [0]. [0] https://blog.benjojo.co.uk/post/auditing-github-users-keys https://blog.benjojo.co.uk/post/auditing-github-users-keys
RaleyField 11y ago
> It's a public key for a reason It's public key because it's named such in the context of public key cryptography. But not all public keys should be available to public. Ideally by default ssh client should use a different key pair for each server('s public key) it connects to. Some people want to hide their identity, for example Tox people chose to be anonymous, what SSH does goes against expectations so it has the ability to betray their choice.
- eru 11y ago
  Not only a different key-pair per server, but also per session.

publysher 11y ago

No, in order to mess with your repo, an attacker would need your private key. Github only publishes public keys. For more information you can check out https://en.wikipedia.org/wiki/Public-key_cryptography https://en.wikipedia.org/wiki/Public-key_cryptography

karlshea 11y ago
GitHub doesn't even have your private key.
yesco 11y ago
Oh yea, duh. Thanks for clearing that up for me, I get the two mixed up a lot. (which is bad)

shmerl 11y ago

To make it easier. Your public key is something others would place on their servers to grant you access, and you'll need to have your private key to authenticate.