4 ms·

Note that `ssh git.charm.sh` is a serious privacy and security hazard: it will leak your local user name and the public keys for any keys you can authenticate w

Note that `ssh git.charm.sh` is a serious privacy and security hazard: it will leak your local user name and the public keys for any keys you can authenticate with (enough to e.g. identify your GitHub account), and if you have ForwardAgent on (convenient but dangerous—if you use it, look into ProxyJump instead) it will allow the remote machine to impersonate you (e.g. push to any GitHub repository you can push to). I recommend using an invocation like this instead when testing things like this; I think it’s enough (but welcome correction): ssh -o PubkeyAuthentication=no -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -a nobody@git.charm.sh

GauntletWizard 4y ago
[flagged]
- dang 4y ago
  We've had to warn you before that personal attacks will get you banned here. Please don't do it again. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- foepys 4y ago
  The last part of your reply is extremely condescending and an absolutely unnecessary ad hominem attack. People have been conscious about publishing their raw email address for ages be a use it attracts all kinds of bad actors, from spambots to outright scammers impersonating somebody else for social engineering. Publishing your social circle involuntarily can be something people actually do not want but are unaware that this is happening.
- chrismorgan 4y ago
  I think you may have misunderstood the privacy hazard I’m talking about. `ssh git.charm.sh` leaks your SSH identities, which is akin to announcing “Hi, I’m gauntletwizard on GitHub” (and quite possibly “I work for ACME Corporation”) by merely connecting, which is not something people are generally aware of or expect (that’s why I pointed it out). This allows for perfect tracking, and such tracking can easily support various nefarious actions. By contrast, HTTP only allows comparatively generic fingerprinting via things like your IP address and user agent characteristics, though certainly in some circumstances it can be possible to identify a user uniquely from these—but you’ll have to work at least a bit for it. More generally, over HTTP if someone wants to know that you’re gauntletwizard on GitHub, they’ll have to go via a GitHub OAuth flow, where you get told they want to know your account name, public email address, whatever, and you get to decide whether to allow this.
Aeolun 4y ago
My public keys are public for a reason though. I can’t imagine why you’d ever turn on ForwardAgent by default.
- colinsane 4y ago
  > My public keys are public for a reason though. in the ideal, yes. but it wasn’t long ago (start of covid really) that i kept my personal and work ssh keys under the same profile. both of those alone are “public”, but that they correspond to the same identity perhaps ought not to be. yeah, there are better ways to manage separate identities (separate users, VMs, VPNs)… and reminding people that `ssh host-name` can reveal all your ssh keys is a good way to push people toward those better solutions! :)
  - Aeolun 4y ago
    > reminding people that `ssh host-name` can reveal all your ssh keys is a good way to push people toward those better solutions! I guess I just take issue with the fear mongering. People often make it sound like the end of the world to not be perfectly anonymous.
  - datadeft 4y ago
    Is this the case with this config as well? Host one HostName one.of.the.server.sh User hn IdentityFile ~/.ssh/one.of.the.server.sh.key
- sneak 4y ago
  Misconfiguration, or lack of understanding of what the agent does and how it works. It's not always clear the inheritance priority of directives with wildcards in ssh_config or .ssh/config. I think it's the opposite of what one might assume is the default, if I recall correctly.
  - Aeolun 4y ago
    I’m not sure, connecting to an unknown server and giving that remote session the same abilities as my local PC has always seemed like a bad idea to me. I guess you could misconfigure it, but it’s one of those things where I’d painstaking ensure I set it up correct because doing it wrong is not an option. Maybe it’s because I almost always go direct?

GauntletWizard 4y ago

[flagged]

dang 4y ago
We've had to warn you before that personal attacks will get you banned here. Please don't do it again. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
foepys 4y ago
The last part of your reply is extremely condescending and an absolutely unnecessary ad hominem attack. People have been conscious about publishing their raw email address for ages be a use it attracts all kinds of bad actors, from spambots to outright scammers impersonating somebody else for social engineering. Publishing your social circle involuntarily can be something people actually do not want but are unaware that this is happening.
chrismorgan 4y ago
I think you may have misunderstood the privacy hazard I’m talking about. `ssh git.charm.sh` leaks your SSH identities, which is akin to announcing “Hi, I’m gauntletwizard on GitHub” (and quite possibly “I work for ACME Corporation”) by merely connecting, which is not something people are generally aware of or expect (that’s why I pointed it out). This allows for perfect tracking, and such tracking can easily support various nefarious actions. By contrast, HTTP only allows comparatively generic fingerprinting via things like your IP address and user agent characteristics, though certainly in some circumstances it can be possible to identify a user uniquely from these—but you’ll have to work at least a bit for it. More generally, over HTTP if someone wants to know that you’re gauntletwizard on GitHub, they’ll have to go via a GitHub OAuth flow, where you get told they want to know your account name, public email address, whatever, and you get to decide whether to allow this.

Aeolun 4y ago

My public keys are public for a reason though. I can’t imagine why you’d ever turn on ForwardAgent by default.

colinsane 4y ago
> My public keys are public for a reason though. in the ideal, yes. but it wasn’t long ago (start of covid really) that i kept my personal and work ssh keys under the same profile. both of those alone are “public”, but that they correspond to the same identity perhaps ought not to be. yeah, there are better ways to manage separate identities (separate users, VMs, VPNs)… and reminding people that `ssh host-name` can reveal all your ssh keys is a good way to push people toward those better solutions! :)
- Aeolun 4y ago
  > reminding people that `ssh host-name` can reveal all your ssh keys is a good way to push people toward those better solutions! I guess I just take issue with the fear mongering. People often make it sound like the end of the world to not be perfectly anonymous.
- datadeft 4y ago
  Is this the case with this config as well? Host one HostName one.of.the.server.sh User hn IdentityFile ~/.ssh/one.of.the.server.sh.key
sneak 4y ago
Misconfiguration, or lack of understanding of what the agent does and how it works. It's not always clear the inheritance priority of directives with wildcards in ssh_config or .ssh/config. I think it's the opposite of what one might assume is the default, if I recall correctly.
- Aeolun 4y ago
  I’m not sure, connecting to an unknown server and giving that remote session the same abilities as my local PC has always seemed like a bad idea to me. I guess you could misconfigure it, but it’s one of those things where I’d painstaking ensure I set it up correct because doing it wrong is not an option. Maybe it’s because I almost always go direct?