Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New startup sells coffee through SSH

terminal.shop

Post reply on HN
Print view View original

251–260 of 430 posts

Re: New startup sells coffee through SSH

#251

Post by Jenda_ »

fragmede wrote: post #208
glennpratt wrote: post #145

Earlier quoted context omitted.

I'm curious why you added `-i /dev/null`. IIUC, this doesn't remove ssh-agent keys. If you want to make sure no keys are offered, you'd want: ssh -a -o IdentitiesOnly=yes terminal. Shop I'm not sure if the `-i` actually prevents anything, I believe things other than /dev/null will still be tried in sequence.

Check for yourself with ssh -v -i /dev/null terminal.shop vs ssh -v terminal.shop What you're looking for is that there is no line that says something like debug1: Offering public key: /Users/fragmede/.ssh/id_rsa RSA SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Upon further testing, the full command you want is: ssh -a -i /dev/null -o IdentityAgent=/dev/null terminal.shop to forcibly disable a local identity ag…

For a cool example (deanonymization), see https://words.filippo.io/dispatches/whoami-updated/ (discussed at time: https://news.ycombinator.com/item?id=34301768). Someone has crawled public keys from GitHub (tbh I was surprised that GitHub publishes them) and set up a database.

Re: New startup sells coffee through SSH

#253

Post by dingosity »

dingosity wrote: post #252

Happy to see this didn't work scp foo.txt terminal.shop:. I was worried for a second they hadn't thought of that.

Though obviously, something like

    scp evil_passwd_file terminal.shop:/etc/passwd
or

    scp evil_authorized_keys terminal.shop:.ssh/authorized_keys
is really the kind of thing you don't want. But if you can't copy foo.txt into your home directory, you probably can't copy attacker versions of more sensitive files into sensitive locations.

Re: New startup sells coffee through SSH

#254

Post by heavyset_go »

rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

Using discoverable and non-discoverable keys via FIDO security keys will require PIN + physical confirmation, or just physical confirmation, by default if anyone tries to use your agent's keys.

Re: New startup sells coffee through SSH

#256

Post by quesera »

atq2119 wrote: post #160
lxe wrote: post #5

Interesting. I like this. No need for a cookie banner.

There is never a good reason for cookie banners, by definition. The rule is that if you have a good reason for your cookies (i.e., basically one that isn't user-hostile), you have nothing to worry about and don't need a cookie banner. It's only when you engage in user-hostile practices, such as tracking, that you need to ask for consent. I'm being sightly snarky, but that's really the essence of it.

You are not wrong.

But beware the predatory lawyers who will come after you for ostensible violations of California’s Invasion of Privacy Act, California Penal Code section 630, et seq. (“CIPA”).

One company I work with received multiple arbitration demands (claimed "privacy" damages in excess of $25000 each, helpfully offered to settle for $5000 each!). And this company didn't even set any cookies or run any 3P tracking on their site!

Their (famous-you-know-them, expensive, California-based) lawyers said "yes, we are seeing this more and more. We can fight and win for $200K, or you can pay the $50K of claims outstanding and add a banner to your site".

Their CEO chose the less-expensive option. :-/

Re: New startup sells coffee through SSH

#257

Post by quesera »

dezren39 wrote: post #32
lxe wrote: post #5

Interesting. I like this. No need for a cookie banner.

it's a us company they don't need a cookie banner anyways

Be careful. If you have California customers you need to worry about California’s Invasion of Privacy Act, California Penal Code section 630, et seq. (“CIPA”).

It's not clear that it applies to the web! But predatory lawyers will come after you for it, if you are big enough and don't have a cookie banner.

Re: New startup sells coffee through SSH

#258

Post by Intralexical »

fragmede wrote: post #47
rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

The full command you want is: ssh -a -i /dev/null terminal.shop to disable agent forwarding, as well as to not share your ssh public key with them, but that's just a little less slick than saying just: ssh terminal.shop to connect.

I just ran it in a `tmpfs` without any credentials:

    $ bwrap --dev-bind / / --tmpfs ~ ssh terminal.shop

Re: New startup sells coffee through SSH

#260

Post by binkHN »

thih9 wrote: post #198
rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

This is only a threat if you enable agent forwarding for all hosts. If you enable agent forwarding for all hosts then yes, data will be forwarded. Your link says: > Don’t enable agent forwarding when connecting to untrustworthy hosts. Fortunately, the ~/.ssh/config syntax makes this fairly simple

Like you noted, ForwardAgent no is the default in /etc/ssh/ssh_config.
Post reply on HN