3 ms·
Underlying tech is “Openpubkey”. https://github.com/openpubkey/openpubkey https://github.com/openpubkey/openpubkey BastionZero just builds on top of that to p
by xyst 2y ago
Underlying tech is “Openpubkey”.
https://github.com/openpubkey/openpubkey https://github.com/openpubkey/openpubkey
BastionZero just builds on top of that to provide a “seamless” UX for ssh sessions and some auditing/fedramp certification.
Personally, not a fan of relying on CF. Need less centralization/consolidation into a few companies. It’s bad enough with MS dominating the OS (consumer) space. AWS dominating cloud computing. And CF filling the gaps between the stack.
- ranger_danger 2y agoCompletely agree. I also don't want to trust certificate authorities for my SSH connections let alone CF. Would not be surprised if it/they were compromised.
- yjftsjthsd-h 2y ago> I also don't want to trust certificate authorities for my SSH connections let alone CF. Would not be surprised if it/they were compromised. OpenPubkey, or in general? Normal SSH CAs don't do PKI like browsers use, you make and trust your own CA(s). And if an attacker can compromise your CA private key, why can't they compromise your SSH private key directly?
- looofooo0 2y agohttps://www.usenix.org/system/files/login/articles/105484-Gutmann.pdf https://www.usenix.org/system/files/login/articles/105484-Gu... + People just don't check ssh keys normally.
- yjftsjthsd-h 2y agoThat's about host keys, not user keys. And... I'm struggling to think of a threat model where that problem manifests in a compromise? Like, what's your threat model? That said, CAs actually really help with that problem, because if a server has its host keys signed with a CA and then the user trusts that CA then they don't have to TOFU the host keys.
- looofooo0 2y agohttps://www.usenix.org/system/files/login/articles/105484-Gutmann.pdf https://www.usenix.org/system/files/login/articles/105484-Gu... Well better than current run of things.
- lmz 2y agoBy "just builds on top of that" it sounds like the same people are building it https://news.ycombinator.com/item?id=41929483 https://news.ycombinator.com/item?id=41929483 (compare username against GH repo).
- EthanHeilman 2y agoCan confirm, I am same person
- aethros 2y agoThe people at BastionZero built openpubkey. They are the paper authors. https://eprint.iacr.org/2023/296 https://eprint.iacr.org/2023/296 They didn't "build on top of"--they built the thing.
- debarshri 2y agoI think teleport operates in similar style.
- datadeft 2y ago> BastionZero just builds on top of that to provide a “seamless” UX Isn't this what many of the companies do?
- deleted 2y ago[deleted]
- EthanHeilman 2y agoAuthor of OpenPubkey here (now at Cloudflare). Happy to answer any OpenPubkey questions.