4 ms·
It's a public key for a reason. You need to the private key to authenticate, so you're safe having everyone know your public key.
by kevinastone 11y ago
It's a public key for a reason. You need to the private key to authenticate, so you're safe having everyone know your public key.
- nly 11y agoIt's fairly pointless of github to publish your public key though. Nobody can trust that it's actually yours.
- chrisfosterelli 11y agoIf you trust your connection to Github and trust that the person in control of the account is the person the account represents, then why not trust that key?
- the8472 11y ago> It's fairly pointless If it enables security research it's already a win in my eyes. Might expose classes of weak keys in the future for example.
- chrisfosterelli 11y agoGreat point. That's already happened, and a lot of weak keys were found [0]. [0] https://blog.benjojo.co.uk/post/auditing-github-users-keys https://blog.benjojo.co.uk/post/auditing-github-users-keys
- RaleyField 11y ago> It's a public key for a reason It's public key because it's named such in the context of public key cryptography. But not all public keys should be available to public. Ideally by default ssh client should use a different key pair for each server('s public key) it connects to. Some people want to hide their identity, for example Tox people chose to be anonymous, what SSH does goes against expectations so it has the ability to betray their choice.
- eru 11y agoNot only a different key-pair per server, but also per session.