3 ms·
What were the implications of this? Could anyone with that key have cloned any GitHub repo, private or not?
by EMIRELADERO 4y ago
What were the implications of this? Could anyone with that key have cloned any GitHub repo, private or not?
- progval 4y agoThis is the host key, so allows impersonating the server to clients, not impersonating clients to the server.
- 8organicbits 4y agoImpersonating the server allows code theft. > Could anyone with that key have cloned any GitHub repo, private or not? If you try to push to GitHub but someone is MITMing you with the leaked key, they can say "I'm an empty repo" and the client will helpfully push all the commits to the attacker. Until everyone updates their .ssh/known_hosts file, a MITM attack can still steal code in this way.