3 ms·
Usability would be improved if there was a one-click way to verify it. Off the top of my head a QR code you could scan so it'd be enough "out of band" that the
by bentcorner 3y ago
Usability would be improved if there was a one-click way to verify it. Off the top of my head a QR code you could scan so it'd be enough "out of band" that the odds of a compromise affecting both paths would be unlikely. Ideally someone smarter than me would come up with a way that it wouldn't require TOFU at all.
- m-p-3 3y agoA well-known URI that provides SSH keys would be nice.
- dambi0 3y agoHow would you encrypt / authenticate the URI? Assuming TLS adding this dependency to configure SSH may not be that desirable in some cases. The original SSH threat model allowed for MITM, so you’d have to also allow for that happen to the SSH key distribution URI. Context is key, it’s an interesting trade-off
- dinosaurdynasty 3y agoOr you know SSHFP records + DNSSEC to verify hostkeys. Which is something OpenSSH already supports.