4 ms·
Informing users when your keys were leaked is more important than user retention. Hiding your weaknesses does not build trust.
by deckar01 10y ago
Informing users when your keys were leaked is more important than user retention. Hiding your weaknesses does not build trust.
- jvehent 10y agoYou're missing the point: SSH does not provide a host key rotation/revocation mechanism. TLS does.
- deckar01 10y agoYou said that you are afraid of loosing users after a leak, which implies if you don't have to, you won't tell your users about the incident.
- eximius 10y agoNo, its that the fix is client side and painful. They can tell their users to fix it and they would rather leave than do it.
- deckar01 10y agoI thought users would be prompted to accept a new fingerprint. Am I missing something?
- billyhoffman 10y agoIf by "prompted" you mean: @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ IT IS POSSIBLE THAT SOMONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now! Then, yes, users will be prompted in the scariest possible language. Compare this with HTTPS/browsers, which care not a lick if a certificate/fingerprint is different, provided that the certificate is valid and the chain is trusted.
- ibotty 10y agoWhich --coincidentally-- is exactly the problem with it.
- deleted 10y ago[deleted]
- jvehent 10y agoNo. I said that changing the key, which must happen, will trigger a warning that will scare users away. Which is (partly) why no one uses SSH with non technical populations.
- tedunangst 10y agoYou can use cert signed keys with ssh.
- TimWolla 10y agoIt does provide host key rotation in OpenSSH 6.8+: http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.html http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.ht...
- jvehent 10y agoThis technique assumes the operator is OK with taking a few weeks for all users to register the new host key. In the event of a leak, revocation of the leaked key must be immediate. That's why we have CRLs (and OneCRL) and OCSP.
- freshhawk 10y agoMore important to the users probably, or at least it should be. Not remotely close to more important to the investors. I certainly agree with you that I would like things to be this way, to live in that world with you. But we don't.