Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ssh whoami.filippo.io

words.filippo.io

Post reply on HN
Print view View original

21–30 of 90 posts

Re: ssh whoami.filippo.io

#22

Post by [deleted] »

Waterluvian wrote: post #19

The idea of walking up to a lock and saying “here are all of my keys. Do any unlock you?” is kind of weird and backwards. But I realize, thinking about it, I was doing that all the time at a previous job where I’d just mash my entire wallet against the keycard reader. Bonus tangent: join me in playing “Payment Roulette” where you mash your wallet against payment terminals and let your credit and debit cards sort out…

[deleted]

Re: ssh whoami.filippo.io

#24

Post by j1elo »

Just for those curious about it:

  $ ssh whoami.filippo.io

      +---------------------------------------------------------------------+
      |                                                                     |
      |             _o/ Hello!                                              |
      |                                                                     |
      |                                                                     |
      |  Did you know that ssh sends all your public keys to any server     |
      |  it tries to authenticate to? You can see yours echoed below.       |
      |                                                                     |
      |  We tried to use them to lookup your GitHub account,                |
      |  but got no match :(                                                |
      |                                                                     |
      |  -- Filippo (https://filippo.io)                                    |
      |                                                                     |
      |                                                                     |
      |  P.S. The source of this server is at                               |
      |  https://github.com/FiloSottile/whoami.filippo.io                   |
      |                                                                     |
      +---------------------------------------------------------------------+
Of course, this happens because the day I learned about the default behavior of SSH (to send all your keys in hope that one works), I went ahead to disable it to stop remote servers from being able to inspect all my keys. I feel this can be abused in a similar way that sites abuse browser information to fingerprint users. So I put this at the bottom of ~/.ssh/config:

  Host *
      IdentitiesOnly yes
And then I explicitly indicate what key to use for each server, either with the "-i" argument, or adding entries above the previous lines:

  Host example.com
      IdentityFile ~/.ssh/example.com.pem
Other commenter mentioned that something similar can be achieved with "PubkeyAuthentication no", but I've been using "IdentitiesOnly yes" for years without issue.

Re: ssh whoami.filippo.io

#25

Post by rjh29 »

o_____________o wrote: post #7

You can turn this behavior off in .ssh/config with Host * PubkeyAuthentication no Put that at the bottom of the file, then turn back on for each host: Host site.com PubkeyAuthentication yes

This seems like bad advice, password auth is less secure than key auth^. And many servers don't accept password-based auth at all.

^password is sent to the server directly; passwords are generally weak and easy to brute force. Pubkeys without a passphrase _can_ be stolen from the local machine, but if an attacker has access to your local machine, you are probably SOL anyway.

edit: as several people have pointed out, this config option does not completely prevent pubkey auth being used (i.e. if configured or overriden on the command line). But if you only use that config by itself, it will disable pubkey authentication for every host.

Re: ssh whoami.filippo.io

#26

Post by yoaquim »

j1elo wrote: post #24

Just for those curious about it: $ ssh whoami.filippo.io +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use them to lookup your GitHub account, | | but got no match :( | | | | -- Filippo (https://filippo.io) | | | | |…

What, if any, are the downsides to this?

Is it just as OP states in article, where you have to interact with the authentication process to provide a key (assuming no key is associated to host as you explain)?

Re: ssh whoami.filippo.io

#27

Post by xwolfi »

tcard wrote: post #5
woodruffw wrote: post #3

Earlier quoted context omitted.

I think it's pretty clever, and demonstrates something very powerful about GitHub's position as de facto global code repository: you can get a strong cryptographic identity for (almost) anyone on the service, which you can then sign/encrypt to, verify for, etc. age (another tool of Filippo's) leverages this to make encrypting to any GitHub user easy[1]. [1]: https://github.com/FiloSottile/age#encrypting-to-a-github-u…

> you can get a strong cryptographic identity for (almost) anyone on the service, which you can then sign/encrypt to, verify for, etc. I made https://sshign.tcardenas.me/ to take advantage of this. For example: [1] In the end, it isn't that useful. I only routinely sign digitally to deal with the (Spanish) government, and they provide their own certificates and software to do that. [1] https://sshign.tcardenas.me/?si…

In Hong Kong and France where I pay taxes we seem to only use passwords. Sadly nobody has hacked my tax account and paid them for me :D

Re: ssh whoami.filippo.io

#28

Post by rjh29 »

yoaquim wrote: post #26
j1elo wrote: post #24

Just for those curious about it: $ ssh whoami.filippo.io +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use them to lookup your GitHub account, | | but got no match :( | | | | -- Filippo (https://filippo.io) | | | | |…

What, if any, are the downsides to this? Is it just as OP states in article, where you have to interact with the authentication process to provide a key (assuming no key is associated to host as you explain)?

The downside is that if you use a large range of servers, you will have to configure them to tell SSH what identities to use. This can be cumbersome if you ssh by alias (e.g. 'foo' rather than 'foo.yourcompany.com').

If you only SSH into servers you trust (a sensible practice) then the benefit is marginal.

Re: ssh whoami.filippo.io

#29

Post by addingnumbers »

rjh29 wrote: post #25
o_____________o wrote: post #7

You can turn this behavior off in .ssh/config with Host * PubkeyAuthentication no Put that at the bottom of the file, then turn back on for each host: Host site.com PubkeyAuthentication yes

This seems like bad advice, password auth is less secure than key auth^. And many servers don't accept password-based auth at all. ^password is sent to the server directly; passwords are generally weak and easy to brute force. Pubkeys without a passphrase _can_ be stolen from the local machine, but if an attacker has access to your local machine, you are probably SOL anyway. edit: as several people have pointed out,…

That's a petty interpretation, it's a big leap reading "don't send your unique identity to strange servers by default" as "never use private keys, always use passwords instead."

Nothing about that config snippet precludes using private keys for known servers.

Re: ssh whoami.filippo.io

#30

Post by nerdbert »

rjh29 wrote: post #25
o_____________o wrote: post #7

You can turn this behavior off in .ssh/config with Host * PubkeyAuthentication no Put that at the bottom of the file, then turn back on for each host: Host site.com PubkeyAuthentication yes

This seems like bad advice, password auth is less secure than key auth^. And many servers don't accept password-based auth at all. ^password is sent to the server directly; passwords are generally weak and easy to brute force. Pubkeys without a passphrase _can_ be stolen from the local machine, but if an attacker has access to your local machine, you are probably SOL anyway. edit: as several people have pointed out,…

I have that line in my .ssh/config and I never use password auth.

I explicitly list every server that I want to connect to in the config file, so I know exactly what is going to happen.

Post reply on HN