4 ms·

I really don’t think there’s anything obvious about the fact that logging into an SSH server also exposes other login information stored in your computer. Given

by untog 7y ago

I really don’t think there’s anything obvious about the fact that logging into an SSH server also exposes other login information stored in your computer. Given that creating a Github account is one of the first things beginner devs are guided towards it’s worth keeping such beginners in mind. And it’s not so much “places you’re not supposed to” as “places you know haven’t been compromised in any way”, which is difficult to know unless you’re the sysadmin.

luckycharms810 7y ago
Well specifically it is sharing the public keys that you have in your SSH folder. It's like trying all your keys in a a keyhole since you don't know which one gets you in. This is really no fault of SSH - the fault lies completely with Github for sharing all their users' public SSH keys.
- saagarjha 7y ago
  …but they're public keys.
  - meddlepal 7y ago
    This. Exactly what are we afraid of here? It's working as designed.
    - ben0x539 7y ago
      It's not directly a security problem as in your computer is gonna get hacked, but it can ruin your opsec if you don't want people to realize that you're the person controlling a specific key.
      - meddlepal 7y ago
        I would hope if you're doing serious opsec you're using ephemeral keys or isolated virtual environments for various endeavors.
        exabrial 7y ago
        Yep. I would also hope if you're 'doing opsec' you would know how your tools work.
  - luckycharms810 7y ago
    You are definitely right in that the public keys themselves don’t present a threat. I think on a penetration test this would show up as “Information Revealed” rather than something that is “Exploitable”. By sharing a username - you might be able to correlate this person to other platforms and technically increase your attack surface area.
raggi 7y ago
For example there was an RCE in iTerm2 in October, whenever tmux integration is turned on (https://nvd.nist.gov/vuln/detail/CVE-2019-9535 https://nvd.nist.gov/vuln/detail/CVE-2019-9535). It's unlikely you have a good reason to believe your terminal stack is secure.
exabrial 7y ago
The fact that people are using this tool regularly and fail to grep a basic understanding of what and how the protocol works in mind blowing.
- untog 7y ago
  Is it really? It’s what Github recommends for every new user without explaining in real depth what’s going on.

by untog 7y ago

luckycharms810 7y ago

Well specifically it is sharing the public keys that you have in your SSH folder. It's like trying all your keys in a a keyhole since you don't know which one gets you in. This is really no fault of SSH - the fault lies completely with Github for sharing all their users' public SSH keys.

saagarjha 7y ago
…but they're public keys.
- meddlepal 7y ago
  This. Exactly what are we afraid of here? It's working as designed.
  - ben0x539 7y ago
    It's not directly a security problem as in your computer is gonna get hacked, but it can ruin your opsec if you don't want people to realize that you're the person controlling a specific key.
    - meddlepal 7y ago
      I would hope if you're doing serious opsec you're using ephemeral keys or isolated virtual environments for various endeavors.
      - exabrial 7y ago
        Yep. I would also hope if you're 'doing opsec' you would know how your tools work.
- luckycharms810 7y ago
  You are definitely right in that the public keys themselves don’t present a threat. I think on a penetration test this would show up as “Information Revealed” rather than something that is “Exploitable”. By sharing a username - you might be able to correlate this person to other platforms and technically increase your attack surface area.

raggi 7y ago

For example there was an RCE in iTerm2 in October, whenever tmux integration is turned on (https://nvd.nist.gov/vuln/detail/CVE-2019-9535 https://nvd.nist.gov/vuln/detail/CVE-2019-9535). It's unlikely you have a good reason to believe your terminal stack is secure.

exabrial 7y ago

The fact that people are using this tool regularly and fail to grep a basic understanding of what and how the protocol works in mind blowing.

untog 7y ago
Is it really? It’s what Github recommends for every new user without explaining in real depth what’s going on.