ssh whoami.filippo.io • Hacker News Board

Re: ssh whoami.filippo.io

#11

Post by [deleted] » Sun, Jan 08, 2023, 11:39 PM UTC

bhaney wrote: post #6

$ ssh whoami.filippo.io @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: POSSIBLE DNS SPOOFING DETECTED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ The ED25519 host key for whoami.filippo.io has changed I guess I've tried this before

[deleted]

Re: ssh whoami.filippo.io

#12

Post by [deleted] » Sun, Jan 08, 2023, 11:39 PM UTC

andrewstuart wrote: post #8

[flagged]

[deleted]

Re: ssh whoami.filippo.io

#13

Post by voidfunc » Sun, Jan 08, 2023, 11:40 PM UTC

frutiger wrote: post #9

andrewstuart wrote: post #8

[flagged]

> lifts your public keys. That's why they're called "public".

I have PTSD from trying to explain that public keys are meant to be shared despite the word "key".

Re: ssh whoami.filippo.io

#14

Post by FiloSottile » Sun, Jan 08, 2023, 11:41 PM UTC

andrewstuart wrote: post #8

[flagged]

It lifts your public keys as much as "git clone git@github.com" does.

They are not stored long-term anywhere, FWIW.

Re: ssh whoami.filippo.io

#15

Post by broodbucket » Sun, Jan 08, 2023, 11:42 PM UTC

andrewstuart wrote: post #8

[flagged]

There's no mention of all your public keys being stored on connection, right? It's just comparing public keys it gets sent against what's already public on GitHub

Re: ssh whoami.filippo.io

#16

Post by detaro » Sun, Jan 08, 2023, 11:43 PM UTC

andrewstuart wrote: post #8

[flagged]

what does "lifted" mean in the context of your public keys (that you published at GitHub if it can tie them to anything?)?

Re: ssh whoami.filippo.io

#17

Post by josephcsible » Sun, Jan 08, 2023, 11:44 PM UTC

andrewstuart wrote: post #8

[flagged]

This is like saying there should be a warning for every single website that it lifts your IP address and user agent.

Re: ssh whoami.filippo.io

#18

Post by fxtentacle » Sun, Jan 08, 2023, 11:50 PM UTC

Today I learned that GitHub keeps a publicly accessible list of all pubkeys linked to each user's account.

Re: ssh whoami.filippo.io

#19

Post by Waterluvian » Sun, Jan 08, 2023, 11:52 PM UTC

The idea of walking up to a lock and saying “here are all of my keys. Do any unlock you?” is kind of weird and backwards.

But I realize, thinking about it, I was doing that all the time at a previous job where I’d just mash my entire wallet against the keycard reader.

Bonus tangent: join me in playing “Payment Roulette” where you mash your wallet against payment terminals and let your credit and debit cards sort out which is going to pay.

Re: ssh whoami.filippo.io

#20

Post by naniwaduni » Sun, Jan 08, 2023, 11:53 PM UTC

frutiger wrote: post #9

andrewstuart wrote: post #8

[flagged]

> lifts your public keys. That's why they're called "public".

It does highlight a critical difference between "security" and "privacy", though.