5 ms·
What a fantastic way to get people to give you the private key and tell you what host it's for.
by fatbird 14y ago
What a fantastic way to get people to give you the private key and tell you what host it's for.
- Firehed 14y agoI'm not about to install that extension and find out myself as that could cause some... serious problems... but that was my first thought as well. What's to stop this from doing something nefarious? Its sandboxing privileges are not remotely clear from what's in the app store, and I don't see of any reasonable way to contain what it can and cannot do. Granted this is equally a problem with any terminal emulator that you didn't compile yourself after examining the source code, but I have quite a bit more faith in Apple and the various Linux repo maintainers than some random guy publishing to the chrome app store. I don't know if Google even claims to vet its contents, but if they do I know they do a terrible job because I've ripped open some extensions to confirm they're doing some sketchy stuff (nothing insecure or worrying, more like adding affiliate links to your entire browsing experience)
- captn3m0 14y agoI've been using this for quite some time, and there are basically two use-cases: a)alternate to putty for windows and b)an actual shell in your browser (You press Alt+1 instead of Alt-tab). The source for the extension is available at http://git.chromium.org/gitweb/?p=chromiumos/platform/assets.git;a=tree;f=chromeapps/hterm http://git.chromium.org/gitweb/?p=chromiumos/platform/assets... Also, handing it private keys is completely optional.
- farnulfo 14y agoDo you know if it could be call from a link in a web page ?
- kwn11 14y agoThis is not some random guy publishing on chrome app store. This app is officially developed by Google.
- GauntletWizard 14y agoNot only that, it's an official part of our Oncall toolkit. I've got coworkers for whom a chromebook is now the primary (and only) laptop, even when oncall.
- riffraff 14y agowhat else is there? I don't remember hearing about this "oncall toolkit" before and I'm fairly curious.
- GauntletWizard 14y agoNothing that matters; Everyone needs to carry around their corporate laptop, one-time-password token, and have configured VPN and ssh clients. The rest varies by team and job role.
- thefreeman 14y agoThe only thing I can see this being useful for is Chromebooks where you cannot install a real ssh client.
- notum 14y agoGreat point regarding private keys. Even if you trust the extension (no reason not to, really), a future bug in chrome could expose local storage to sites you visit, other extensions etc. /paranoid I don't troll interwebz from my terminal/putty, so I'd say there's a smaller risk of that happening there. On a side note, add passwords to private keys :)
- abraham 14y agoIt is an official Google extension. I doubt they would try to steel any private keys.
- davidandgoliath 14y agoMaybe they'll... iron out the kinks.
- meaty 14y agoYes just like their WiFi probing thing that they got in trouble for and blamed it on a rogue developer...
- Garbage 14y agoFor clarification on most of the keys related concerns, please read the FAQ - http://git.chromium.org/gitweb/?p=chromiumos/platform/assets.git;a=blob;f=chromeapps/hterm/doc/faq.txt http://git.chromium.org/gitweb/?p=chromiumos/platform/assets...
- acqq 14y agoI don't see that the whole source is published, exactly like the whole source of Chrome is not being published (Chromium is Chrome minus "the souce", e.g. additional code (for what?), installers etc). I haven't even seen any analysis of all the stuff Google does in the pieces of the code that aren't published. It can be done, somebody should just really want to do that. Disclaimer: I avoid Chrome browser exactly because I don't have enough information to know if they really "aren't evil." I don't claim there isn't such information somewhere, just that I don't know about it. My worries are exactly because their installers install more like a malware than like clean projects ("no we aren't going to let you to simply download executables, just click here, give us administrative privileges and enjoy when we download what we want and change on your machine what we like"). Anybody who knows more?
- jrockway 14y agoJust use Chromium instead. You can audit every single line of code and build it from scratch on your own machine with your own reflections-on-trusting-trust-safe-compiler. Or you can install Debian's version.
- vidarh 14y ago[For the unaware, "Reflections on trusting trust" by Ken Thompson is a must read: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html ]
- madethemcry 14y agoNever heard of this. I just read it twice to understand it. Great explanation of a widely unknown problem I guess. From now on I will never ever tell people an application is safe if you can look into the source code. Thank you so much!!
- est 14y agothe Chrome Apps can call chrome.socket, which can listen/connect any tcp/udp connections http://developer.chrome.com/apps/socket.html http://developer.chrome.com/apps/socket.html So no, private key is still private.