Earlier quoted context omitted.
sometimes you just sudo -s
I prefer su -
You need a root password for that one.
Show HN: My SSH server knows who you are
161–170 of 257 posts
Re: Show HN: My SSH server knows who you are
#162"Public keys" are supposed to be public anyway, isn't that what it's designed for? I see no harm
Not necessarily. The "public" in "public key" is not an announcement of intended global availability, but rather role in contrast to "private key". There are many reasons people or systems might want to keep "public keys" obscured or pseudonymous.
Still, many probably don't mind the public disclosure of Github account public keys.
But, the more serious issue here goes beyond that. In an unexpected and likely unintended way, one's Github identity is revealed to a third party, along with your origin IP and quite possibly other SSH keys used with other systems.
It's that set of mappings – IP Github identity other identities – that violates expectations.
Re: Show HN: My SSH server knows who you are
#163FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…
F
Re: Show HN: My SSH server knows who you are
#164It seems that I get no output because I have an SSH certificate:
robryk@sharya-rana ~> ssh -v whoami.filippo.io
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/robryk/.ssh/id_rsa
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Offering RSA-CERT public key: /home/robryk/.ssh/id_rsa
Connection closed by 178.32.139.168Re: Show HN: My SSH server knows who you are
#165Didn't work for me. Here's what I got. I cleaned out .ssh/knownhosts after connecting. +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use that to find your GitHub username, but we | | couldn't :( maybe you don't even h…
Hi! A few reasons it might fail: * You don't have your SSH keys on GitHub * You don't have your GitHub keys on that laptop * Your key is not RSA (because I'm LAZY) * Your ssh version uses only recent algorithms not supported by Go's x/crypto/ssh * You actually disabled IdentityKeys Nothing to do with usernames or heuristics, by the way. All it does is first enumerate your client keys, then let you in, then check a hu…
I'm using ed25519 with Github, figured it was just laziness. (also deliberately set it up to send that key because it wouldn't normally).
Re: Show HN: My SSH server knows who you are
#166I brought this attack up on reddit 3 years ago. http://www.reddit.com/r/crypto/comments/xf6pa/openssh_offers... Glad to see someone implemented an attack and can demonstrate it well now. Cheers Filippo.
"attack"
Re: Show HN: My SSH server knows who you are
#167Earlier quoted context omitted.
I also use the -c (confirm) flag with ssh-add. I don't forward the agent willy-nilly, but if someone still manages to compromise the agent, I will hopefully know when I'm getting confirmation popups I didn't initiate.
I wish gnome-keyring's integrated ssh agent supported that.
It's been awhile since I set it up, but I believe I've disabled gnome-keyring's agent[1], use the OpenSSH one instead, use ssh-askpass-keyring[2] as the SSH_ASKPASS environment variable to ssh-add to read key passphrases from the keyring (manually invoked via a shell script helper; but only needs to be done once per login session), and GNOME's gnome-ssh-askpass installed as the system default, for key confirmations.
(This is on the Cinnamon desktop, so other GNOME setups could be different.)
[1] See https://askubuntu.com/questions/63407/where-are-startup-comm... for how to override in your user dir, or find it in the GUI somewhere. [2] https://launchpad.net/ssh-askpass-keyring is the Ubuntu page
Re: Show HN: My SSH server knows who you are
#168Earlier quoted context omitted.
I also use the -c (confirm) flag with ssh-add. I don't forward the agent willy-nilly, but if someone still manages to compromise the agent, I will hopefully know when I'm getting confirmation popups I didn't initiate.
I wish gnome-keyring's integrated ssh agent supported that.
[deleted]
Re: Show HN: My SSH server knows who you are
#169"Public keys" are supposed to be public anyway, isn't that what it's designed for? I see no harm
Using the same public key on two sites is like using the same username - something that you would do only if you want your identity linked between those sites. It's also a much stronger proof of identity than having the same username, because that's what they were designed for.
So don't use the same public key on two different site
Re: Show HN: My SSH server knows who you are
#170At first, I thought that this is pretty harmless, but now I suspect that there may be a way to exploit a dump of public keys tied to personal information: let's say that some powerful adversary (like NSA) uses some kind of rainbow tables to associate public keys with private. Having a lot of public keys, they are likely to know some private ones and identities behind them. This hypothesis requires some mathematical g…
> rainbow tables
There is no such thing in public key crypto.
The only thing that comes close to it that I can think of is the problem where weak public parameters were hard coded in a library (Apache) and were used by many many many person. Look at the logjam paper.