Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signing in to websites with SSH

vtllf.org

Post reply on HN
Print view View original

51–60 of 169 posts

Re: Signing in to websites with SSH

#51

Post by loudmax »

ams6110 wrote: post #15

I've worked in support of computing clusters that are widely used by researchers. By far the most common problem people had with using these systems was grokking ssh keys. Masters and PhD Computer Science people are routinely baffled by them, provide their private keys instead of their public keys, or provide both, etc. People in general just don't get public/private key pairs. Any solution that requires any awarenes…

It will never change as long as using public/private key pairs is something exotic most people rarely use. I was baffled too when I first started using ssh keys, but today it's second nature. I get how they work, at least on a theoretical level. And I think most of us here on HN are like that. This isn't about being smart or of a mathematical bent, it just comes down to practice.

Re: Signing in to websites with SSH

#52

Post by k__ »

vog wrote: post #42
jasonkester wrote: post #31

"SSH is near-universally loved among developers." Really? Which developers? SSH is one of those things you get forced to deal with a couple times a year for some irritating task, and it involves firing up Putty, figuring out where you left your key file, trying to remember how to actually load that key file, and a bunch of following steps on some website just to get connected to what you were trying to connect to. It…

Note that although PuTTY has a graphical user interface, it is hardly user friendly. Using the command-line ssh (with a decent shell) is much more comfortable.

It's still a nice SSH client

Re: Signing in to websites with SSH

#53

Post by nothrabannosir »

geocar wrote: post #14

No need for custom url formats. Keep it really simple: Use a and rely on browsers to prompt us to "log in with ssh". IF there's no public key, the browser could offer to run ssh-keygen for the user and save the results in the user's keychain. If we use switcher[1], we can even put ssh and https on the same hostname and on the same point. This would be a recommended configuration since it would get through most proxie…

And please, please, please add the fingerprint to that:

Or whatever your fancy, I don't care how, but please add that fingerprint.

SSH displaying the user a fingerprint on first connect and allowing it to accept is its worst UI mistake.

Re: Signing in to websites with SSH

#54

Post by mkorfmann »

IgorPartola wrote: post #38
ddebernardy wrote: post #36

I'm suspicious that this is any better than TLS and client certificates. Plus, it's not entirely clear what's supposed to happen when your family and friends are using your computer, or when your laptop is simply stolen.

Surely you passphrase protect your id_rsa!

Back to entering passwords (or passphrases for that matter)... Yay!

Re: Signing in to websites with SSH

#56

Post by xnyhps »

So you have a situation where the client has already authenticated the server using TLS, and now the server wants to authenticate the client too. This solution wants to do that by setting up a new channel, authenticating the server /again/ and then also the client.

Yeah, I don't think this is a good idea.

Re: Signing in to websites with SSH

#57

Post by nly »

The only substantial advantage to this scheme is you get server id pinning for free (via your known_hosts file), but a combination of HTTP public key pinning[0] and client-side certificates will give you all the same advantages with far less user effort.

[0] https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...

Re: Signing in to websites with SSH

#58

Post by themattrix »

nly wrote: post #44
jerinaw wrote: post #18

What about this solution? https://www.grc.com/sqrl/sqrl.htm

SQRL is vulnerable to phishing and spoofing attacks due to the lack of mutual authentication. I can send you a phishing email with a link to a webpage that looks like PayPal, on mynastydomain.com, and then display an actual PayPal QR code to you. There's no complete solution to this all the time you're passing tokens with an unauthenticated association over an air gap. The IP binding proposal is a just a disaster for…

Care to expand on this a bit? I'm somewhat familiar with SQRL, but what was this IP binding proposal all about?

Is this a use-case not discussed in the SQRL phishing page?

https://www.grc.com/sqrl/phishing.htm

Re: Signing in to websites with SSH

#59

Post by [deleted] »

nly wrote: post #44
jerinaw wrote: post #18

What about this solution? https://www.grc.com/sqrl/sqrl.htm

SQRL is vulnerable to phishing and spoofing attacks due to the lack of mutual authentication. I can send you a phishing email with a link to a webpage that looks like PayPal, on mynastydomain.com, and then display an actual PayPal QR code to you. There's no complete solution to this all the time you're passing tokens with an unauthenticated association over an air gap. The IP binding proposal is a just a disaster for…

[deleted]

Re: Signing in to websites with SSH

#60

Post by falcolas »

I love this idea, but I have some issues with their chart, particularly as related to authentication via email.

A developer with a few minutes of thinking time could get around the "red" spots associated with email authentication, and fill in any missing dots pretty easily.

And for better or worse, email is currently one of the better ways to create an identity for the masses, and it's also one of the few systems that your average user can justify the pain of setting up 2 factor auth on.

The only thing better would be to use text messages, if you could come up with a way to lower the impedance for the user.

Post reply on HN