3 ms·
Another point worth bringing up: it'd be nice if we set up either a PGP-like trust ring for host SSH signatures, or relied on a set of CAs like we do for TLS.
by necovek 3y ago
Another point worth bringing up: it'd be nice if we set up either a PGP-like trust ring for host SSH signatures, or relied on a set of CAs like we do for TLS.
Something as simple as confirm-fingerprint-over-https (eg. look for https://ssh-host/.host-ssh-fingerprint https://ssh-host/.host-ssh-fingerprint) could work if enough ssh clients used it.
- dentarg 3y agoYou can do that with DNS (preferably DNSSEC is used): https://en.wikipedia.org/wiki/SSHFP_record https://en.wikipedia.org/wiki/SSHFP_record, https://man.openbsd.org/ssh_config#VerifyHostKeyDNS https://man.openbsd.org/ssh_config#VerifyHostKeyDNS