4 ms·
SSH could really use a better default key fingerprint. It's 42 characters of base64. So a hodgepodge of upper and lower case Latin characters with some numbers
by upofadown 3y ago
SSH could really use a better default key fingerprint. It's 42 characters of base64. So a hodgepodge of upper and lower case Latin characters with some numbers and special characters mixed in. Not even any spaces to give it some structure. Basically just the output of of a 256 bit hash dumped directly to the terminal.
Perhaps more people would check it if the usability was improved...
- bentcorner 3y agoUsability would be improved if there was a one-click way to verify it. Off the top of my head a QR code you could scan so it'd be enough "out of band" that the odds of a compromise affecting both paths would be unlikely. Ideally someone smarter than me would come up with a way that it wouldn't require TOFU at all.
- m-p-3 3y agoA well-known URI that provides SSH keys would be nice.
- dambi0 3y agoHow would you encrypt / authenticate the URI? Assuming TLS adding this dependency to configure SSH may not be that desirable in some cases. The original SSH threat model allowed for MITM, so you’d have to also allow for that happen to the SSH key distribution URI. Context is key, it’s an interesting trade-off
- dinosaurdynasty 3y agoOr you know SSHFP records + DNSSEC to verify hostkeys. Which is something OpenSSH already supports.
- tedunangst 3y agoTurn on ascii art.
- susam 3y ago> SSH could really use a better default key fingerprint. It's 42 characters of base64. You can get an ASCII graphic for the host key with the VisualHostKey option. For example: ssh -o VisualHostKey=yes tty.sdf.org Alternatively, you can set this option permanently in the SSH client configuration like this: echo VisualHostKey yes >> ~/.ssh/config ssh tty.sdf.org Here is an example output: $ ssh -o VisualHostKey=yes tty.sdf.org Host key fingerprint is SHA256:ZjwbO7AU8rHJExYrmZS2LqGZ7WfdoELfMrF54W92PYA +--[ED25519 256]--+ | ... | | .oo o | | .=.* | | . .* B | | = o O S. | |+ + o.o*E=. | | o o O.++ o | | o X = +.. o | | + + +.. . | +----[SHA256]-----+ user@tty.sdf.org's password: This graphic looks like a pigeon to me. Similarly, the one for github.com looks like a cat to me. For each server I connect to via SSH I know what the ASCII art for the host key looks like. This familiarity aids in performing TOFU in a hassle-free manner.
- jjav 3y agoYes, highly recommended. Easy to get used to the visual pattern of your important servers and notice if anything is off.
- lozenge 3y agoI would be interested in how good "looks like a cat to me" would be. It's trivial to generate 100,000 SSH keys and automatically select the most visually similar one. But would you notice the mismatch.
- CaptainFever 3y agoThe modern way seems to be a short string of emojis, ala Telegram voice calls.