3 ms·
If you want SSH access to Github or Gitlab, you'll need to paste your pubkey there. Leaking your user@host can be a concern if you're trying to maintain anonymi
by sillysaurus3 10y ago
If you want SSH access to Github or Gitlab, you'll need to paste your pubkey there. Leaking your user@host can be a concern if you're trying to maintain anonymity, e.g. Gwern, particularly if your username is your real name. You can strip out the user@host part from the paste, but it's safer to just get rid of it. It's easy to accidentally paste the whole thing into an .ssh/authorized_keys file, for example.
Admittedly this isn't an issue for most people.
- glandium 10y agoIf you're trying to maintain anonymity, why is your username your real name?
- sillysaurus3 10y agoEven if it's not, your default hostname when using a MacBook Pro is typically "<username>s-MacBook-Pro.local" which reveals you're using a MacBook Pro. That info leak probably doesn't matter, but generally you want to reveal as little information as possible.
- nitrogen 10y agoAs one example, a hostname leak might hypothetically be useful for a spearfishing+XSS attack.
- acranox 10y agoWhat kind of person cares enough about anonymity to change the comment in their ssh key, but not change the default hostname of their Mac? That person is very inconsistent.
- minitech 10y agoWhy does ssh-keygen include unnecessary information by default?
- throwaway7767 10y agoBecause it helps usability when the user is editing ~/.ssh/authorized_keys - if the default is not changed, the key comment has some context, so finding the right key is easier. I strip comments from my SSH keys too for the same reason you do. But most people don't seem to care and there is a reason for the default.
- deleted 10y ago[deleted]
- tokenizerrr 10y agoHardly unnecessary. Very useful to see which key is what when you have multiple.
- Esau 10y agoYour right. I just checked mine and it was: esau@europa.hsd1.fl.comcast.net Not a big deal but it does reveal my ISP and state.
- dozzie 10y agoComment section is set to what it is because this is easier way to tell where the public key comes from. It vastly simplifies key management, which is much more important than the tiny bits of anonymity you get from not setting the comment.
- ptero 10y agoAnonymity is a different issue from security. You might get a little extra of that by taking user info from keys, but IMO for anonymity you should ensure your user info does not link to the real person.
- raimue 10y agoGitHub does not display the comment of the SSH key to the public, check yourself: https://github.com/<username>.keys https://github.com/<username>.keys
- walrus01 10y agoYou're writing as if a person can only ever have one pubkey, you can create a new pair just for github.
- Latty 10y agoIt's worth noting both GitHub and GitLab strip the comment off the keys. https://github.com/Lattyware.keys https://github.com/Lattyware.keys - GitHub leave it blank: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGAx5F7iJTDwbPrdhrTtVdQRtozcRDvGNuU7BB+4+mHi ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6WfINFFvzT+Z+l5sYq9zJoyXPLL27v9vvE1+p1XOiW https://gitlab.com/latty.keys https://gitlab.com/latty.keys - GitLab add a generated comment: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6WfINFFvzT+Z+l5sYq9zJoyXPLL27v9vvE1+p1XOiW Gareth Latty (gitlab.com) ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGAx5F7iJTDwbPrdhrTtVdQRtozcRDvGNuU7BB+4+mHi Gareth Latty (gitlab.com) In my case, I'd actually quite like the comments to be left in, one of those is my personal key, one is for work. Differentiating is useful depending on why I have access.
- deleted 10y ago[deleted]
- sillysaurus3 10y agoCertainly, but your user@host will be leaked to the staff of Github / Gitlab and to anyone that compromises your account. The unfortunate thing about anonymity is that a small mistake can be costly. It depends what your threat model is, though.
- yo-code-sucks 10y agoLeaking? Thats not leaking, it's the comment field of the key, you can change it to anything you'd like using -C ssh-keygen -b 4096 -t rsa -C someshitidontwanttotellyou