Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New startup sells coffee through SSH

terminal.shop

Post reply on HN
Print view View original

221–230 of 430 posts

Re: New startup sells coffee through SSH

#221

Post by throwaway984393 »

rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

[dead]

Re: New startup sells coffee through SSH

#222

Post by hnarn »

jolmg wrote: post #93
rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

Default is disabled.

Exactly, this tip only applies if you reconfigured ssh to automatically forward agent to all hosts, which is absolutely insane.

Re: New startup sells coffee through SSH

#224

Post by zzo38computer »

miki123211 wrote: post #169

I can't test this due to the product being out of stock, but I wonder what their approach to PCI compliance is. Processing credit card data has a high compliance burden if you're unwilling to use a secure widget made by an already-authorized provider like Stripe. That's for a good reason, most web and mobile apps are designed such that their backend servers never see your full credit card number and CVV. You can't do…

I think that a better way (which is protocol-independent, and does not require a web browser, or even necessarily an internet connection), would be a kind of payment specification which is placed inside of a order file. This payment specification is encrypted and digitally signed and can be processed by the bank or credit card company or whatever is appropriate; it includes the sender and recipient, as well as the amount of money to be transferred (so that they cannot steal additional money), and possibly a hash of the order form. A payment may also be made by payphones or by prepaid phone cards (even if you do not have a bank account nor a credit card), in which case you may be given a temporary single-use key which can be used with this payment specification data; if you do not do this, then you can use the credit card instead.

Re: New startup sells coffee through SSH

#225

Post by teruakohatu »

LeoPanthera wrote: post #64
rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

"ForwardAgent no" in ~/.ssh/config will do this automatically.

Is "Host * \n AddKeysToAgent yes" acceptable from a security POV or should that also be per host?

Re: New startup sells coffee through SSH

#226

Post by abc_lisper »

rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

Dang. Didn't know this was a thing. Thank you!

Re: New startup sells coffee through SSH

#228

Post by daft_pink »

objektif wrote: post #72
normsbee wrote: post #57

This is so cool! Just imagine a world where you can run `getcoffee latte` and have a latte show up at your door 20 minutes later.

Your receipt: - latte 5.99 - delivery fees 5.99 - ssh fees 0.99 - internet fees 0.59 - water 0.19 - sewage 0.09 …..

someone call the ftc lol
Post reply on HN