I love ssh apps! See also late.sh, and my own https://shellbox.dev
another one: https://pico.sh
Show HN: ssh ssh.place
31–40 of 126 posts
Re: Show HN: ssh ssh.place
#32Re: Show HN: ssh ssh.place
#33Time for your regular reminder that ssh has no PKI and is trivial to mitm during tofu.
Yes, but what exactly would an attacker achieve by doing mitm here?
Re: Show HN: ssh ssh.place
#34Nice, I first saw this on Hack Club ;) Check your terminal to see if it supports certain colours, on mine the darker and lighter colours (eg. maroon/red, purple/magenta) look identical.
Re: Show HN: ssh ssh.place
#35Hey, is it not just a simple honeypot reverse hack ssh server? People understand that reverse hacking can happen when connecting to random ssh server, right?
> People understand that reverse hacking can happen when connecting to random ssh server, right?
No, actually, I've never heard of such a vector. How would that work?
Re: Show HN: ssh ssh.place
#36Time for your regular reminder that ssh has no PKI and is trivial to mitm during tofu.
I understand that most people don't use it and indeed rely on tofu, but the statement is not absolutely correct.
ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers). And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls
Re: Show HN: ssh ssh.place
#37Wish we had a WebSSH like WebSockets / IRC v3.
Re: Show HN: ssh ssh.place
#38Hey, is it not just a simple honeypot reverse hack ssh server? People understand that reverse hacking can happen when connecting to random ssh server, right?
> People understand that reverse hacking can happen when connecting to random ssh server, right? No, actually, I've never heard of such a vector. How would that work?
Vulnerability in your ssh client (unlikely) or terminal emulator (more common but lower reach).
Re: Show HN: ssh ssh.place
#39Hey, is it not just a simple honeypot reverse hack ssh server? People understand that reverse hacking can happen when connecting to random ssh server, right?
> People understand that reverse hacking can happen when connecting to random ssh server, right? No, actually, I've never heard of such a vector. How would that work?
An ssh server would exploit a vulnerability in the ssh client when it connects.
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
Re: Show HN: ssh ssh.place
#40Hey, is it not just a simple honeypot reverse hack ssh server? People understand that reverse hacking can happen when connecting to random ssh server, right?
Is that more likely than getting hacked when visiting a website?
Visiting a random website is the normal use of HTTP. With SSH, there might be assumptions of connecting to a trusted server you have an account with and likely own. It's not very normal to ssh to a random server.