Live data from Hacker News

Is anybody using this private key?

isanybodyusingthisprivatekey.com

51–54 of 54 posts

Re: Is anybody using this private key?

#51

Do not give out your private keys anywhere except where they're needed. They are meant to be private for a reason. If this service was serious, it'd instead rely on fingerprints (sha256/sha512) and not the key itself.

Wouldn't it being making the matter worse? You wouldn't know if it's a collision of the hash or of the keys themselves

Assuming for the sake of argument this were a real service checking for matches, the chances of a hash collision with SHA256 is effectively 0.[1] I entered the limit for BIGINT (9223372036854775807), and the approximation of the probability of a hash collision after generating 9223372036854775807 items in SHA256 is zero. The exact probability would probably take eons to calculate, but it's vanishingly close to zero.

1. https://kevingal.com/apps/collision.html

Re: Is anybody using this private key?

#53
post #13

Earlier quoted context omitted.

Is there any case where they ever need to be shared? If you need a login, generate a new one.

How would I get my ssh keys to the remote server from a new machine? To me, the easiest way seems to be either sharing private keys from a different machine, or having some way to deterministically generate keys from a password or keyphrase, and the latter seems more secure to me because I don't have to trust a middle man to do the transferring.

Generate a new private/public key pair on the new machine and then copy the public key (from the new machine) into the authorised keys (on the server) using a login that already has access (e.g. from the old machine).
Post reply on HN