3 ms·

Tell HN: Browsers accept SSH:// protocol links

3 points by keepamovin 2y ago

Wow, i mean, I'm amazed. I thought i knew a lot of the standard "intent" protocols (mailto, tel, itunes related, skype, etc) - I had no idea ssh was supported. It's pretty cool that SSH is supported. In that vein I think tmate should update their GitHub actions runner output line (for runner SSHing) to be an actual URL you can click on to save an annoying copy/paste/edit saga.

deleted 2y ago
[deleted]
ggm 2y ago
"accept" on Chrome/OSX meaning "throws to the terminal" which in many ways is pretty much what you'd want. perhaps other browsers internalise this into a soft term in WebGL or something but I am content if I click one its normal SSH .ssh/config parsing and normal ssh-agent keys. But now I wonder if there is some information leakage risk here. Aren't I going to reveal my key existences to <outside> from this? Feels like somebody can scrape my keyID and then track me in flow somehow unknown from this.
- mubou 2y ago
  For me on Windows it just prompts to open WinSCP, which registered itself under `HKEY_CLASSES_ROOT\ssh`, the same as Chrome does for any other unknown protocol.
  - ggm 2y ago
    probably could tune it to an ssh app, if I had one. Terminal running ssh is fine by me!
  - keepamovin 2y ago
    For me sadf://asdfsad Goes to google search on Chrome, and Safari just refuses. There might be some way this leaks ssh public key information (it's a normal ssh session afterall) - but you have to hit OK on the intent modal. My bet is there could be a vuln in the URL parsing of these scheme links. It's probably not so simple, but it screams: "Shell injection" when you can have a protocol link that ends up opening up a CLI app. But to be clear, I am in no way against the protocol links caps of browsers, especially SSH, I think it's super useful. Most likely all such bugs would be found by now - but maybe something more complex, some specially crafted SSH url on some systems might be able to trigger something unintended (pun intented haha :))
someothherguyy 2y ago
https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml https://www.iana.org/assignments/uri-schemes/uri-schemes.xht...
- keepamovin 2y ago
  Some of these! lol - This page is a resource of quirky interesting HN posts in itself! :)

3 points by keepamovin 2y ago

deleted 2y ago

[deleted]

ggm 2y ago

"accept" on Chrome/OSX meaning "throws to the terminal" which in many ways is pretty much what you'd want. perhaps other browsers internalise this into a soft term in WebGL or something but I am content if I click one its normal SSH .ssh/config parsing and normal ssh-agent keys. But now I wonder if there is some information leakage risk here. Aren't I going to reveal my key existences to <outside> from this? Feels like somebody can scrape my keyID and then track me in flow somehow unknown from this.

mubou 2y ago
For me on Windows it just prompts to open WinSCP, which registered itself under `HKEY_CLASSES_ROOT\ssh`, the same as Chrome does for any other unknown protocol.
- ggm 2y ago
  probably could tune it to an ssh app, if I had one. Terminal running ssh is fine by me!
- keepamovin 2y ago
  For me sadf://asdfsad Goes to google search on Chrome, and Safari just refuses. There might be some way this leaks ssh public key information (it's a normal ssh session afterall) - but you have to hit OK on the intent modal. My bet is there could be a vuln in the URL parsing of these scheme links. It's probably not so simple, but it screams: "Shell injection" when you can have a protocol link that ends up opening up a CLI app. But to be clear, I am in no way against the protocol links caps of browsers, especially SSH, I think it's super useful. Most likely all such bugs would be found by now - but maybe something more complex, some specially crafted SSH url on some systems might be able to trigger something unintended (pun intented haha :))

someothherguyy 2y ago

https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml https://www.iana.org/assignments/uri-schemes/uri-schemes.xht...

keepamovin 2y ago
Some of these! lol - This page is a resource of quirky interesting HN posts in itself! :)