4 ms·

Is that setup common?

• soheil 5y ago
  It doesn't have to be for at least some unsuspecting users to unwittingly share their private key with some random server on the internet. When was the last time you ssh'd to a server you didn't already have some level of trust with? (AWS, GCP, work server farms, etc.)
  • spijdar 5y ago
    Not GP, but pretty frequently, although my situation is not normal. I'd still suggest that sharing your keys by default is ... a bad idea. Sure, fingerprints help, but there's the chance of accidentally or maliciously being redirected to a rogue server.
    • soheil 5y ago
      I agree * is unsafe, but then again ssh devs chose to include it so that means they deemed it not completely useless, thus there are probably enough people who use it to make this thread somewhat malicious. Also if you or another script once added * to your .ssh/config long ago it may still be lurking there among other lines without you realizing. I agree checking fingerprints helps, but that can turned off pretty easily too.