Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New startup sells coffee through SSH

terminal.shop

Post reply on HN
Print view View original

361–370 of 430 posts

Re: New startup sells coffee through SSH

#361

Post by arghwhat »

rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

Just to be clear, ssh agent forwarding is disabled by default and enabling it is always a hazard when connecting to machines that others also have access to.

Not at all specific to this.

Re: New startup sells coffee through SSH

#362

Post by arghwhat »

fragmede wrote: post #208
glennpratt wrote: post #145

Earlier quoted context omitted.

I'm curious why you added `-i /dev/null`. IIUC, this doesn't remove ssh-agent keys. If you want to make sure no keys are offered, you'd want: ssh -a -o IdentitiesOnly=yes terminal. Shop I'm not sure if the `-i` actually prevents anything, I believe things other than /dev/null will still be tried in sequence.

Check for yourself with ssh -v -i /dev/null terminal.shop vs ssh -v terminal.shop What you're looking for is that there is no line that says something like debug1: Offering public key: /Users/fragmede/.ssh/id_rsa RSA SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Upon further testing, the full command you want is: ssh -a -i /dev/null -o IdentityAgent=/dev/null terminal.shop to forcibly disable a local identity ag…

Offering your public key only allows them to identify the key and prove you have it. There is no security concern in sending this to an untrusted server.

Agent forwarding is a whole other beast.

Re: New startup sells coffee through SSH

#363

Post by throwaway5371 »

hn_throwaway_99 wrote: post #268
srinathkrishna wrote: post #171

Earlier quoted context omitted.

They mention in the faq that they use Stripe - https://www.terminal.shop/faq . Stripe does offer integrations that are not natively using their widgets. Ultimately, the PII data is stored at Stripe. PS: I work at Stripe but I don't really work on the PCI compliant part of the company.

The fact that the card number data is stored at Stripe doesn't matter that much. As parent commenter says, the card numbers are still visible on terminal.shop's network because it all goes over their SSH connection. For most websites that use the Stripe widget, the website owner can never see the full card number, because the credit card number entry fields are iframed in on the page. That means website owners in thi…

you can say the same about the widget, as the website embedding the widget has access to the document's keydown

Re: New startup sells coffee through SSH

#365

Post by trallnag »

orblivion wrote: post #136
LeoPanthera wrote: post #64

Earlier quoted context omitted.

"ForwardAgent no" in ~/.ssh/config will do this automatically.

Is it "yes" by default? If so, that seems insane given what the op said about it. But other comments say it's "no" by default. If it's "no" by default, why are people alarming us by bringing this up? And why for terminal.shop in particular?

It's off by default. No idea what this fuzz is about. Gathering internet attention points maybe?

Re: New startup sells coffee through SSH

#366

Post by makingstuffs »

throwaway5371 wrote: post #363
hn_throwaway_99 wrote: post #268

Earlier quoted context omitted.

The fact that the card number data is stored at Stripe doesn't matter that much. As parent commenter says, the card numbers are still visible on terminal.shop's network because it all goes over their SSH connection. For most websites that use the Stripe widget, the website owner can never see the full card number, because the credit card number entry fields are iframed in on the page. That means website owners in thi…

you can say the same about the widget, as the website embedding the widget has access to the document's keydown

If the widget is in an iframe with a different host the parent documents JS engine has no way of interacting with the child.

Re: New startup sells coffee through SSH

#367

Post by rhysmdnz »

makingstuffs wrote: post #366
throwaway5371 wrote: post #363

Earlier quoted context omitted.

you can say the same about the widget, as the website embedding the widget has access to the document's keydown

If the widget is in an iframe with a different host the parent documents JS engine has no way of interacting with the child.

The parent documents JS engine can replace the iframe with their own that looks the same

Re: New startup sells coffee through SSH

#368

Post by ansc »

jjeaff wrote: post #310
hn_throwaway_99 wrote: post #268

Earlier quoted context omitted.

The fact that the card number data is stored at Stripe doesn't matter that much. As parent commenter says, the card numbers are still visible on terminal.shop's network because it all goes over their SSH connection. For most websites that use the Stripe widget, the website owner can never see the full card number, because the credit card number entry fields are iframed in on the page. That means website owners in thi…

it's been a while since I did the full pci compliance rigamarole, but I don't recall it being that difficult. you basically just answer a bunch of questions correctly about how you are transmitting and storing the data using sufficient encryption and then they run some automated pen tests on your site and then you are done.

It's expensive.

Re: New startup sells coffee through SSH

#369

Post by mercora »

rvnx wrote: post #40

One safety tip: disable SSH Agent Forwarding before you connect, otherwise the remote server can theoretically reuse your private key to establish new connections to GitHub.com or prod servers (though this host is unlikely malicious). https://www.clockwork.com/insights/ssh-agent-hijacking/ (SSH Agent Hijacking)

You can configure the agent to confirm each key usage to have your cake and eat it too. :)

It's also good to see if any malicious process tries to make use of the agent locally!

Re: New startup sells coffee through SSH

#370

Post by pmx »

I_o_IllI__o_I wrote: post #271

Not to dunk on the coffee which I haven't tried but this seems like a viral ad? I get it's cool that this actually works, but in practice how is it different to selling coffee through an API through a generic web interface served by shopify? In the end in both ways they are selling you coffe beans for money. It's still cool to see it in your terminal though.

> It's still cool to see it in your terminal though

This is the whole point, I think. Things can exist just because they're fun :)

Post reply on HN