SSH Keys on GitHub • Hacker News Board

Re: SSH Keys on GitHub

#41

Post by adelevie » Tue, Aug 18, 2015, 6:22 PM UTC

I'd love to see an open source project around scanning the GitHub API and subscribing to alerts for your org's repos.

Re: SSH Keys on GitHub

#42

Post by daenney » Tue, Aug 18, 2015, 6:24 PM UTC

I see your SSH keys and raise you a .netrc: https://github.com/search?p=1&q=filename%3Anetrc&ref=searchr...

Re: SSH Keys on GitHub

#43

Post by xiata » Tue, Aug 18, 2015, 6:29 PM UTC

People always forget about the other keys...

filename:id_ed25519 filename:id_rsa filename:id_dsa filename:id_ecdsa

Re: SSH Keys on GitHub

#44

Post by 0x0 » Tue, Aug 18, 2015, 6:38 PM UTC

bagels wrote: post #2

Does Github have a responsibility to help people out with this kind of thing? What do you all think?

I think it would be very useful for repositories to have a default server-side push hook that scans for the most common mistakes, rejecting the push while printing an URL to a page explaining what's going on and with a checkbox for opting out on the check for future pushes to that repo.

Re: SSH Keys on GitHub

#45

Post by iamroot » Tue, Aug 18, 2015, 7:33 PM UTC

peterwwillis wrote: post #34

geographomics wrote: post #28

Looks like they've blocked it now. Searching via Google still works though: https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid...

id_rsa is being blocked right now, but id_dsa and id_ecdsa still work.

adding wildcards works as well, eg: id_rsa?

Re: SSH Keys on GitHub

#46

Post by iamroot » Tue, Aug 18, 2015, 7:35 PM UTC

H2CO3 wrote: post #26

Update: This is no longer working: https://imgur.com/uT1fCRT

adding wildcards works, eg: id_rsa?

Re: SSH Keys on GitHub

#47

Post by michaelmior » Tue, Aug 18, 2015, 7:37 PM UTC

Couto wrote: post #36

mosburger wrote: post #29

Hmmph. I just found a bunch of free AWS keys by searching for amazon.yml, too. What is the best way to share things like API keys among a team of developers, anyway? I'm surprised this hasn't been solved already (perhaps it has and I just don't know about it). I know you can share passwords with tools like LastPass and 1Password, and I suppose you could use those for API keys as well? It'd be nice if you could, e.g.,…

I'm not sure if there are other ways, better or not... but blackbox[1] can be used to store secrets. And it might be possible to achieve some success with git filters[2], at least to avoid pushing secrets into the repository. Still... just my two cents, I'm not exactly a pro-user of those two features [1]( https://github.com/StackExchange/blackbox ) [2]( https://stackoverflow.com/questions/6557467/can-git-ignore-a...…

If you decide to take the git filters approach, git-crypt[0] is a good choice.

[0] https://github.com/AGWA/git-crypt

Re: SSH Keys on GitHub

#48

Post by bradleyland » Wed, Aug 19, 2015, 9:32 PM UTC

avinassh wrote: post #25

And if you want to get the public key also: .keys" rel="nofollow">https://github.com/ .keys ex.: https://github.com/avinassh.keys

No need. You can recover the public key from a private key using ssh-keygen's 'y' option:

-y This option will read a private OpenSSH format file and print an OpenSSH public key to stdout.

For example:

ssh-keygen -y -f id_rsa > id_rsa.pub