2 ms·
"accept" on Chrome/OSX meaning "throws to the terminal" which in many ways is pretty much what you'd want. perhaps other browsers internalise this into a soft
by ggm 2y ago
"accept" on Chrome/OSX meaning "throws to the terminal" which in many ways is pretty much what you'd want.
perhaps other browsers internalise this into a soft term in WebGL or something but I am content if I click one its normal SSH .ssh/config parsing and normal ssh-agent keys.
But now I wonder if there is some information leakage risk here. Aren't I going to reveal my key existences to <outside> from this? Feels like somebody can scrape my keyID and then track me in flow somehow unknown from this.
- mubou 2y agoFor me on Windows it just prompts to open WinSCP, which registered itself under `HKEY_CLASSES_ROOT\ssh`, the same as Chrome does for any other unknown protocol.
- ggm 2y agoprobably could tune it to an ssh app, if I had one. Terminal running ssh is fine by me!
- keepamovin 2y agoFor me sadf://asdfsad Goes to google search on Chrome, and Safari just refuses. There might be some way this leaks ssh public key information (it's a normal ssh session afterall) - but you have to hit OK on the intent modal. My bet is there could be a vuln in the URL parsing of these scheme links. It's probably not so simple, but it screams: "Shell injection" when you can have a protocol link that ends up opening up a CLI app. But to be clear, I am in no way against the protocol links caps of browsers, especially SSH, I think it's super useful. Most likely all such bugs would be found by now - but maybe something more complex, some specially crafted SSH url on some systems might be able to trigger something unintended (pun intented haha :))