31–40 of 90 posts
Also, maybe don't trust the SSH config defaults on whatever host you're on at the moment. You can explicitly set defaults yourself in your `~/.ssh/config` or similar.
Earlier quoted context omitted.
This seems like bad advice, password auth is less secure than key auth^. And many servers don't accept password-based auth at all. ^password is sent to the server directly; passwords are generally weak and easy to brute force. Pubkeys without a passphrase _can_ be stolen from the local machine, but if an attacker has access to your local machine, you are probably SOL anyway. edit: as several people have pointed out,…
That's a petty interpretation, it's a big leap reading "don't send your unique identity to strange servers by default" as "never use private keys, always use passwords instead." Nothing about that config snippet precludes using private keys for known servers.
Today I learned that GitHub keeps a publicly accessible list of all pubkeys linked to each user's account.
Age (the author's file encryption tool) can make use of this when encrypting a file to send to someone.
Earlier quoted context omitted.
What, if any, are the downsides to this? Is it just as OP states in article, where you have to interact with the authentication process to provide a key (assuming no key is associated to host as you explain)?
The downside is that if you use a large range of servers, you will have to configure them to tell SSH what identities to use. This can be cumbersome if you ssh by alias (e.g. 'foo' rather than 'foo.yourcompany.com'). If you only SSH into servers you trust (a sensible practice) then the benefit is marginal.
You can also use placeholders for keys, so for example I have a ssh config like:
Host *.mycompany.com
# Employer specific yubikey stuff
Host *.mydomain.com
IdentityFile ~/.ssh/keys/id_primary
Host *
IdentitiesOnly yes
IdentityFile ~/.ssh/keys/%r@%h # uses ~/.ssh/keys/git@github.com for github for example
The idea of walking up to a lock and saying “here are all of my keys. Do any unlock you?” is kind of weird and backwards. But I realize, thinking about it, I was doing that all the time at a previous job where I’d just mash my entire wallet against the keycard reader. Bonus tangent: join me in playing “Payment Roulette” where you mash your wallet against payment terminals and let your credit and debit cards sort out…
Just for those curious about it: $ ssh whoami.filippo.io +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use them to lookup your GitHub account, | | but got no match :( | | | | -- Filippo (https://filippo.io) | | | | |…
The idea of walking up to a lock and saying “here are all of my keys. Do any unlock you?” is kind of weird and backwards. But I realize, thinking about it, I was doing that all the time at a previous job where I’d just mash my entire wallet against the keycard reader. Bonus tangent: join me in playing “Payment Roulette” where you mash your wallet against payment terminals and let your credit and debit cards sort out…
Earlier quoted context omitted.
> lifts your public keys. That's why they're called "public".
I have PTSD from trying to explain that public keys are meant to be shared despite the word "key".
The idea of walking up to a lock and saying “here are all of my keys. Do any unlock you?” is kind of weird and backwards. But I realize, thinking about it, I was doing that all the time at a previous job where I’d just mash my entire wallet against the keycard reader. Bonus tangent: join me in playing “Payment Roulette” where you mash your wallet against payment terminals and let your credit and debit cards sort out…
A lot of times the machine would say "Use one card only", won't it? I have a Secrid wallet and I was expecting the aluminium to block the RFID reader except for the 1 card I put in the outer leather pocket, but I still need to open the wallet up and present the dangling card in its sleeve to stop multiple signals...