5 ms·

> Did you know that ssh sends all your public keys to any server it tries to authenticate to? Never really thought about it. Feels kind of "leaky", even if nec

by magnat 4y ago

> Did you know that ssh sends all your public keys to any server it tries to authenticate to? Never really thought about it. Feels kind of "leaky", even if necessary.

EduardoRT 4y ago
Not a big deal at all considering that they're public keys, there's no security concern there. Feels weird, but it's like going into a building that requires a badge and showing proof that you actually own several keys, then the building guard telling you he needs X key to enter since that's the one they know, and it's authorized. All your public keys in your GitHub account are accessible through a link, just <github.com/<username>.keys>
- jonnycomputer 4y ago
  There is a privacy concern. And that might end up being a security concern depending on the threat model (e.g. social engineering attacks).
  - EduardoRT 4y ago
    So, you'd ask someone to SSH into a server, and you'll get some of his public keys (I think the default limit is 5 keys), what would you do with that? You can also just go to their GitHub profile and fetch the keys or ask them to send you their public keys, they're meant to be public after all. Here's one of my public keys, for free: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICIc3nOnSnsiAdkjAdH5WR9enQiPYWq1zAVsTDt60e91
- rgoulter 4y ago
  As well as .keys, there's .gpg for GPG keys, and .png for the profile picture.
- magnat 4y ago
  > Not a big deal at all considering that they're public keys, there's no security concern there. I might be pushing the analogy too far, but: all the URLs I have visited are public and are not identifying me personally, yet uploading them all together to a third party feels like a breach of privacy.
betaby 4y ago
Host * IdentitiesOnly yes To prevent
trey-jones 4y ago
It's definitely a convenience over security feature. My personal feeling is that the convenience is worth it in this case, and it's a sensible default.
rogeliodh 4y ago
remember CVE-2016-0777 (https://news.ycombinator.com/item?id=10901588 https://news.ycombinator.com/item?id=10901588)?

by magnat 4y ago

> Did you know that ssh sends all your public keys to any server it tries to authenticate to? Never really thought about it. Feels kind of "leaky", even if necessary.

EduardoRT 4y ago

Not a big deal at all considering that they're public keys, there's no security concern there. Feels weird, but it's like going into a building that requires a badge and showing proof that you actually own several keys, then the building guard telling you he needs X key to enter since that's the one they know, and it's authorized. All your public keys in your GitHub account are accessible through a link, just <github.com/<username>.keys>

jonnycomputer 4y ago
There is a privacy concern. And that might end up being a security concern depending on the threat model (e.g. social engineering attacks).
- EduardoRT 4y ago
  So, you'd ask someone to SSH into a server, and you'll get some of his public keys (I think the default limit is 5 keys), what would you do with that? You can also just go to their GitHub profile and fetch the keys or ask them to send you their public keys, they're meant to be public after all. Here's one of my public keys, for free: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICIc3nOnSnsiAdkjAdH5WR9enQiPYWq1zAVsTDt60e91
rgoulter 4y ago
As well as .keys, there's .gpg for GPG keys, and .png for the profile picture.
magnat 4y ago
> Not a big deal at all considering that they're public keys, there's no security concern there. I might be pushing the analogy too far, but: all the URLs I have visited are public and are not identifying me personally, yet uploading them all together to a third party feels like a breach of privacy.

betaby 4y ago

Host * IdentitiesOnly yes To prevent

trey-jones 4y ago

It's definitely a convenience over security feature. My personal feeling is that the convenience is worth it in this case, and it's a sensible default.

rogeliodh 4y ago

remember CVE-2016-0777 (https://news.ycombinator.com/item?id=10901588 https://news.ycombinator.com/item?id=10901588)?