101–110 of 257 posts
Let's say I downloaded every public key from GitHub to ~/.ssh. Would this identify me as everyone on GitHub, or just the owner of the first public key to match?
Furthermore, I wonder how Go channels compare to libevent (more specifically, epoll/queue) for high-performance network software. Is there any previous work which compares the two?
Also - everybody should probably be aware that SSH zero-day isn't the only bad thing which can happen to you if you connect to a malicious SSH server. Your terminal emulator has a higher chance of being vulnerable (e.g. take a look here: https://www.proteansec.com/linux/blast-past-executing-code-t...) than openssh does.
P.s. "(And written in Go!)" - the trick would still be very cool if it was written in C, JavaScript, PHP, COBOL or any other language (and it would be freaking awesome if written in brainfuck!).
Earlier quoted context omitted.
Forwarding your keys basically. It's like giving someone you don't know a handshake AND all your keys.
public keys I hope?!
Yes, it's really stupid to enable AgentForwarding.
Earlier quoted context omitted.
Exactly! Once I get the keys I just check them against a scraped database of GitHub keys and ask the API for your name. (And if you have agent forwarding active I show you a big WARNING [0].) There's an explanation in the README [1] but the actually interesting stuff is in server.go [2]. Finally I mentioned a few reasons it might not work for you below [3]. [0] http://git.io/vOVYm [1] https://github.com/FiloSottile/w…
> (And if you have agent forwarding active I show you a big WARNING [0].) It amazes me that people enable that for random servers. Seems like SSH should make that harder. Enabling it for a specific server you trust makes sense; enabling it for all servers doesn't. SSH could reject "ForwardAgent" outside a Host block, for instance, and force you to at least write a "Host *" block. EDIT: Check out this search: https://…
Holy mother of god, can we somehow return to the time when almost nobody used *nix and Microsoft was the one struggling to keep systems of these people secure?
FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You can enumerate all of someone's keys this way (like this SSH server does) If you want to disable this sort of behaviour you can disable SSH from sending keys automatically, and then tell SSH which identity files need to be sent to each host.…
It just closes my connection. root@paragonie:~# ssh whoami.filippo.io Connection to whoami.filippo.io closed. I'm not sure what I'm supposed to be seeing.
...presumably it doesn't allow root logins via SSH
iMac:~ bonf$ ssh whoami.filippo.io Connection to whoami.filippo.io closed.
> Did you know that ssh sends all your public keys to any server it tries to authenticate to? You can see yours echoed below. > We tried to use that to find your GitHub username, but we couldn't :( maybe you don't even have GitHub ssh keys, do you? > By the way, did you know that GitHub publishes all users' ssh public keys and Ben (benjojo.co.uk) grabbed them all? > That's pretty handy at times :) But not this time :…
> By the way, did you know that GitHub publishes all users' ssh public keys and Ben (benjojo.co.uk) grabbed them all? > That's pretty handy at times :) But not this time :( >Better luck next time, I guess :) Who cares if they publish Public Keys. They're meant to be public, it's one of the few well named things in computer science. They are basically meant to be spewn everywhere.