3 ms·

Found me; very nice. I wouldn't have guessed how you did it without the explanation about GitHub. I wonder if this means we should be rotating keys periodical

• delinka 11y ago
  You should be using different key pairs on each client machine you log into. You should also be using different key pairs for each host to which you connect (and using ~/.ssh/config to specify which keys are sent to which hosts.) Not only will this limit correlation as demonstrated here, but also make it much easier to revoke access via keys that may have been compromised.
• latortuga 11y ago
  They're public keys, they're intended to be public. What are you trying to hide by hiding your public key?
  • justizin 11y ago
    Though it may be incredibly impractical or theoretically impossible, depending on the key and time of day, there is always a possibility that a public key can be used as an attack vector to guess a private key.
    • gmalette 11y ago
      Or simply to DOS you out of your other accounts. https://news.ycombinator.com/item?id=10005358 https://news.ycombinator.com/item?id=10005358
  • bartbes 11y ago
    As much as the keys contain public data, I wouldn't consider (but it apparently is) the list of keys with access to my github account public data. Github willingly reveals information about pseudonyms, etc. This is a data vs metadata thing, the data is public, but who it belongs to, and what one can do with it need not be.