3 ms·
Ever hired someone who, when you ask them to send you an ssh key for access to something, sends you their private key? Yeah, that's happened more than once.
by walrus01 4mo ago
Ever hired someone who, when you ask them to send you an ssh key for access to something, sends you their private key? Yeah, that's happened more than once.
- fragmede 4mo agoWho's sending ssh keys around anymore? Just get theirs off gitHub.com/username.keys and shove it in their user account. http://gitHub.com/fragmede.keys http://gitHub.com/fragmede.keys, for example. Stick that in authorized_keys to let me into your server.
- tryauuum 4mo agothis touches two pieces of my knowledge: - microsoft is evil, I cannot delete my github account, will never use anything by this company - if the attacker knows your *public* key they can enumerate the list of the servers you have access to https://github.com/benjojo/ssh-key-confirmer
- walrus01 4mo agoNot everyone works in a field where the developers or engineers have public github accounts or publish their profile of things like ssh keys for the world to read.