5 ms·
Of course, caveats about trusting Github also apply. (If Github got hacked, the page https://github.com/[github https://github.com/[github name].keys would serv
by a3_nm 10y ago
Of course, caveats about trusting Github also apply. (If Github got hacked, the page https://github.com/[github https://github.com/[github name].keys would serve the public key of a fresh attacker-controlled key and would trigger shortly afterwards an SSH login attempt with that key towards the client IP to do evil stuff.)
- uiri 10y agoNot only GitHub but the specific user's account could be compromised through e.g. a weak or reused password. In the general case, you should be fine. Even more so if the person whose GitHub account you are authorizing regularly checks their keys for suspicious activity.
- ams6110 10y agoYou can (and should) verify the key fingerprint out of band.