Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ssh whoami.filippo.io

words.filippo.io

Post reply on HN
Print view View original

41–50 of 90 posts

Re: ssh whoami.filippo.io

#41

Post by Waterluvian »

Arbortheus wrote: post #35
Waterluvian wrote: post #19

The idea of walking up to a lock and saying “here are all of my keys. Do any unlock you?” is kind of weird and backwards. But I realize, thinking about it, I was doing that all the time at a previous job where I’d just mash my entire wallet against the keycard reader. Bonus tangent: join me in playing “Payment Roulette” where you mash your wallet against payment terminals and let your credit and debit cards sort out…

That’s very trusting that there isn’t some race condition on the POS that ends up charging them all.

I’m pretty confident that POS transactions are idempotent. It’s an entire state machine that you’re working through, too, so I doubt it’s capable of performing multiple transactions during the middle of one transaction.

Re: ssh whoami.filippo.io

#43

Post by xwdv »

Arbortheus wrote: post #35
Waterluvian wrote: post #19

The idea of walking up to a lock and saying “here are all of my keys. Do any unlock you?” is kind of weird and backwards. But I realize, thinking about it, I was doing that all the time at a previous job where I’d just mash my entire wallet against the keycard reader. Bonus tangent: join me in playing “Payment Roulette” where you mash your wallet against payment terminals and let your credit and debit cards sort out…

That’s very trusting that there isn’t some race condition on the POS that ends up charging them all.

We’ll know we’re in the future when the payment gets split evenly amongst all participants. It’s like paying down a bill with the power of friendship.

Re: ssh whoami.filippo.io

#44

Post by boarnoah »

fxtentacle wrote: post #18

Today I learned that GitHub keeps a publicly accessible list of all pubkeys linked to each user's account.

Seems questionable on Github's part to have .keys public by default, why not allow people to opt in ex: keybase.io equivalent?

Yes I get that its not sensitive information, but as this demo demonstrates it can fingerprint people who might not be unaware re: this quirk of SSH's coupled with this part of the Github API.

Re: ssh whoami.filippo.io

#45

Post by alexeldeib »

rjh29 wrote: post #32
addingnumbers wrote: post #29

Earlier quoted context omitted.

That's a petty interpretation, it's a big leap reading "don't send your unique identity to strange servers by default" as "never use private keys, always use passwords instead." Nothing about that config snippet precludes using private keys for known servers.

Well that is how I read it :P I think it would be good to point out that you can add other Host sections to override it.

It’s about preventing identity leakage, not using password. I can’t tell if the post was edited, but it already includes how to override per host.

I value this and I universally disable password auth…on the server :)

E: as listed by others, IdentitiesOnly=yes seems like a better approach?

Re: ssh whoami.filippo.io

#46

Post by alexeldeib »

tcard wrote: post #5
woodruffw wrote: post #3

Earlier quoted context omitted.

I think it's pretty clever, and demonstrates something very powerful about GitHub's position as de facto global code repository: you can get a strong cryptographic identity for (almost) anyone on the service, which you can then sign/encrypt to, verify for, etc. age (another tool of Filippo's) leverages this to make encrypting to any GitHub user easy[1]. [1]: https://github.com/FiloSottile/age#encrypting-to-a-github-u…

> you can get a strong cryptographic identity for (almost) anyone on the service, which you can then sign/encrypt to, verify for, etc. I made https://sshign.tcardenas.me/ to take advantage of this. For example: [1] In the end, it isn't that useful. I only routinely sign digitally to deal with the (Spanish) government, and they provide their own certificates and software to do that. [1] https://sshign.tcardenas.me/?si…

Sorry, this web UI encourages me to upload private keys? Immediate nope for serious usage. Nice for testing, like jwt.io, though.

The signature verification is handy.

Re: ssh whoami.filippo.io

#47

Post by akerl_ »

o_____________o wrote: post #7

You can turn this behavior off in .ssh/config with Host * PubkeyAuthentication no Put that at the bottom of the file, then turn back on for each host: Host site.com PubkeyAuthentication yes

This doesn't really turn off the behavior. I think you're looking for IdentitiesOnly and IdentityFile, which lets you tell your client to send only the right key per host, rather than sending all of them until it gets a hit.

Re: ssh whoami.filippo.io

#48

Post by Sparkyte »

o_____________o wrote: post #7

You can turn this behavior off in .ssh/config with Host * PubkeyAuthentication no Put that at the bottom of the file, then turn back on for each host: Host site.com PubkeyAuthentication yes

Excellent way to also do ssh-agent less key site binding for those who are ssh adding a new key. I would always rather manage a key per host than manage it inside of the ever forgetful agent.

Re: ssh whoami.filippo.io

#49

Post by TechBro8615 »

boarnoah wrote: post #44
fxtentacle wrote: post #18

Today I learned that GitHub keeps a publicly accessible list of all pubkeys linked to each user's account.

Seems questionable on Github's part to have .keys public by default, why not allow people to opt in ex: keybase.io equivalent? Yes I get that its not sensitive information, but as this demo demonstrates it can fingerprint people who might not be unaware re: this quirk of SSH's coupled with this part of the Github API.

If you are SSH'ing into a server you should expect to get fingerprinted.

Re: ssh whoami.filippo.io

#50

Post by perryizgr8 »

Since Github SSH keys are public for every account, wouldn't anyone be able to impersonate you if they know your username, if you haven't set up a passphrase? If yes, it is surprising to me that Github does not make it abundantly clear when you add a key. Until now, I thought the only way an attacker can get my keys is if they break into my computer.

Edit: totally disregard this, absolute brain fog moment

Post reply on HN