Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Late.sh – a command-line Clubhouse for computer people

late.sh

Post reply on HN
Print view View original

61–70 of 141 posts

Re: Late.sh – a command-line Clubhouse for computer people

#65

Post by h43z »

Zambyte wrote: post #64
h43z wrote: post #61

Reminder to be cautious about leaking public keys. Once you leak your public key it could be used to check if another server recognizes that leaked public key.

What?

By default SSH leaks all of the below public keys (if they exist) + all public keys in your ssh-agent to a server you connect to.

  ~/.ssh/id_ecdsa.pub
  ~/.ssh/id_ecdsa_sk.pub
  ~/.ssh/id_ed25519.pub
  ~/.ssh/id_ed25519_sk.pub
  ~/.ssh/id_xmss.pub
  ~/.ssh/id_dsa.pub
running `ssh late.sh` would do exactly that.

At the very bottom of the website they give you a command that would not leak your public keys.

`ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh`

this would only send the late_throwaway public key

Re: Late.sh – a command-line Clubhouse for computer people

#66

Post by Zambyte »

h43z wrote: post #65
Zambyte wrote: post #64

Earlier quoted context omitted.

What?

By default SSH leaks all of the below public keys (if they exist) + all public keys in your ssh-agent to a server you connect to. ~/.ssh/id_ecdsa.pub ~/.ssh/id_ecdsa_sk.pub ~/.ssh/id_ed25519.pub ~/.ssh/id_ed25519_sk.pub ~/.ssh/id_xmss.pub ~/.ssh/id_dsa.pub running `ssh late.sh` would do exactly that. At the very bottom of the website they give you a command that would not leak your public keys. `ssh-keygen -t ed25519…

Okay, but why is that something to be concerned about? How would one be able to probe to see if a server recognizes a public key? Why does that matter?

Re: Late.sh – a command-line Clubhouse for computer people

#67

Post by nntlol »

Zambyte wrote: post #66
h43z wrote: post #65

Earlier quoted context omitted.

By default SSH leaks all of the below public keys (if they exist) + all public keys in your ssh-agent to a server you connect to. ~/.ssh/id_ecdsa.pub ~/.ssh/id_ecdsa_sk.pub ~/.ssh/id_ed25519.pub ~/.ssh/id_ed25519_sk.pub ~/.ssh/id_xmss.pub ~/.ssh/id_dsa.pub running `ssh late.sh` would do exactly that. At the very bottom of the website they give you a command that would not leak your public keys. `ssh-keygen -t ed25519…

Okay, but why is that something to be concerned about? How would one be able to probe to see if a server recognizes a public key? Why does that matter?

[dead]

Re: Late.sh – a command-line Clubhouse for computer people

#68

Post by benj111 »

h43z wrote: post #61

Reminder to be cautious about leaking public keys. Once you leak your public key it could be used to check if another server recognizes that leaked public key.

Surely you shouldn't be leaking your username. I could use it to see if another server recognised 'h43z'....

Re: Late.sh – a command-line Clubhouse for computer people

#69

Post by prodigycorp »

Zambyte wrote: post #66
h43z wrote: post #65

Earlier quoted context omitted.

By default SSH leaks all of the below public keys (if they exist) + all public keys in your ssh-agent to a server you connect to. ~/.ssh/id_ecdsa.pub ~/.ssh/id_ecdsa_sk.pub ~/.ssh/id_ed25519.pub ~/.ssh/id_ed25519_sk.pub ~/.ssh/id_xmss.pub ~/.ssh/id_dsa.pub running `ssh late.sh` would do exactly that. At the very bottom of the website they give you a command that would not leak your public keys. `ssh-keygen -t ed25519…

Okay, but why is that something to be concerned about? How would one be able to probe to see if a server recognizes a public key? Why does that matter?

so, i used my public key. can someone please tell me what i should be worried about now?
Post reply on HN