I am glad my email doesn't show up in there.
Obtain a GitHub user's public keys
21–30 of 31 posts
Re: Obtain a GitHub user's public keys
#22Seems like this would be a good way to frame somebody else. Hack into a server, do some damage/steal files, and drop somebody elses public key on the server.
"But I didnt do it!" - Then why was your key on the server?
Re: Obtain a GitHub user's public keys
#23Seems like this would be a good way to frame somebody else. Hack into a server, do some damage/steal files, and drop somebody elses public key on the server. "But I didnt do it!" - Then why was your key on the server?
Because public keys are somewhat publicly available information?
Re: Obtain a GitHub user's public keys
#24Earlier quoted context omitted.
If someone hacked GitHub they'd just get the _public_ keys, same as the ones listed in the link. You can't login on a server with the public key. What he has done is that by adding github ids, he gets the public keys of all the users and adds them to his servers. Now all the users' public keys are already in the system. Now they can login with their private keys and this private key remains _only_ on their own system…
If someone hacked github, they could substitute their own evil key for one of the developers' keys and the automation would add that key to appropriate places, giving access to whomever has the evil private key. On the other hand, OP probably trusts the contents of source repositories stored on github (few people use commit and tag signing); if so he already trusts github with everything.
It really depends upon if the git repo is gpg signed. We really don't know enough about the automation to make any assumptions.
Were I to do it I would require gpg signed commits and setup the trust chain a bit differently. But you're right its likely just a list of git repos that aren't signed.
Re: Obtain a GitHub user's public keys
#25Earlier quoted context omitted.
If someone hacked github, they could substitute their own evil key for one of the developers' keys and the automation would add that key to appropriate places, giving access to whomever has the evil private key. On the other hand, OP probably trusts the contents of source repositories stored on github (few people use commit and tag signing); if so he already trusts github with everything.
It really depends upon if the git repo is gpg signed. We really don't know enough about the automation to make any assumptions. Were I to do it I would require gpg signed commits and setup the trust chain a bit differently. But you're right its likely just a list of git repos that aren't signed.
Signing of the repo contents (commits/tags) doesn't help anyhow with user ssh keys. If the automation gets the keys from github it effectively trusts github completely, irrespective of the situation with repos.
Re: Obtain a GitHub user's public keys
#26Re: Obtain a GitHub user's public keys
#27Earlier quoted context omitted.
It really depends upon if the git repo is gpg signed. We really don't know enough about the automation to make any assumptions. Were I to do it I would require gpg signed commits and setup the trust chain a bit differently. But you're right its likely just a list of git repos that aren't signed.
Signing of the repo contents (commits/tags) doesn't help anyhow with user ssh keys. If the automation gets the keys from github it effectively trusts github completely, irrespective of the situation with repos.
Not necessarily. It could do key pinning for example, which at least protects already-established users.
Re: Obtain a GitHub user's public keys
#28Something similar has been available on Launchpad for years. There's a tool called "ssh-import-id". If I want to give you access to an Ubuntu server, I might type "ssh-import-id kentwistle". This would fetch public keys that the kentwistle user on Launchpad has published over HTTPS and then add them to ~/.ssh/authorized_keys.
I don't think there's any reason that ssh-import-id needs to be Launchpad-specific.
Re: Obtain a GitHub user's public keys
#29Github leverages such content-type negotiation for other resources too: add .diff or .patch to commits or pull requests. There's a way to get git am compatible data too.
Re: Obtain a GitHub user's public keys
#30Is this supposed to be okay? I mean, even though they are public keys, its not like I really want them to be _that_ public!
I also view this as information leakage. I keep some of my online pseudonyms completely separated, and stuff like that allows people to link them together, if I was not careful enough to use a separate ssh key.