It didn't work for me even though I have a github account and ssh key installed from the same machine. Maybe related to the fact I use several keys and keychain to manage keys.
Show HN: My SSH server knows who you are
41–50 of 257 posts
Re: Show HN: My SSH server knows who you are
#42If this surprises people, it's definitely doing some good. Nicely presented, Filippo!
surprise to me. added
IdentitiesOnly yes
to my config file.
Re: Show HN: My SSH server knows who you are
#43Didn't work for me. Here's what I got. I cleaned out .ssh/knownhosts after connecting. +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use that to find your GitHub username, but we | | couldn't :( maybe you don't even h…
Hi! A few reasons it might fail:
* You don't have your SSH keys on GitHub
* You don't have your GitHub keys on that laptop
* Your key is not RSA (because I'm LAZY)
* Your ssh version uses only recent algorithms not supported by Go's x/crypto/ssh
* You actually disabled IdentityKeys
Nothing to do with usernames or heuristics, by the way. All it does is first enumerate your client keys, then let you in, then check a huge GitHub keys database, then ask the GitHub API for your name.
Re: Show HN: My SSH server knows who you are
#44Forgive me ignorance here but what steps should I take to avoid someone from getting my public key off github and then using it to screw with my repos? Was there a major step I missed here when I made these keys?
It's a public key for a reason. You need to the private key to authenticate, so you're safe having everyone know your public key.
It's fairly pointless of github to publish your public key though. Nobody can trust that it's actually yours.
Re: Show HN: My SSH server knows who you are
#45[deleted]
Re: Show HN: My SSH server knows who you are
#46Good thing I use HTTP to push to Github (or not?)
Just use another key. I have like 20. It sucks that doing this is pretty complicated though. Separation of identities is crucial on the internet.
Re: Show HN: My SSH server knows who you are
#47Re: Show HN: My SSH server knows who you are
#48A great reminder that public key identity management is quite the unsolved annoyance. Why should you use the same key everywhere, allowing others to track you? Ideally you would have one key per service.
Re: Show HN: My SSH server knows who you are
#49"don't worry, I don't have any OpenSSH 0day" > That's exactly what someone with a 0 day would say!
Someone with an OpenSSH client 0day would just quietly open an SSH port and wait about five minutes for the next sucker. You don't have to phish on HN to get people to connect to an SSH port.
But I wouldn't get access to all these "DevOps-style" startups backends... Oh. Oh, I shouldn't have said that.
;)
Re: Show HN: My SSH server knows who you are
#50Earlier quoted context omitted.
It's a public key for a reason. You need to the private key to authenticate, so you're safe having everyone know your public key.
It's fairly pointless of github to publish your public key though. Nobody can trust that it's actually yours.
If you trust your connection to Github and trust that the person in control of the account is the person the account represents, then why not trust that key?