61–70 of 90 posts
Today I learned that GitHub keeps a publicly accessible list of all pubkeys linked to each user's account.
Seems questionable on Github's part to have .keys public by default, why not allow people to opt in ex: keybase.io equivalent? Yes I get that its not sensitive information, but as this demo demonstrates it can fingerprint people who might not be unaware re: this quirk of SSH's coupled with this part of the Github API.
Before SSH-ing into untrusted hosts, make sure you understand what SSH agent-forwarding and X11-forwarding are. Also, maybe don't trust the SSH config defaults on whatever host you're on at the moment. You can explicitly set defaults yourself in your `~/.ssh/config` or similar.
Are they enabled by default when running SSH?
The existence of lesser-known things like this, combined with the defaults of SSH clients, and the rabid promotion of keypair auth instead of passwords, really makes one wonder whether there is some ulterior motive to make it easier to deanonymise and thus track users...
Earlier quoted context omitted.
The downside is that if you use a large range of servers, you will have to configure them to tell SSH what identities to use. This can be cumbersome if you ssh by alias (e.g. 'foo' rather than 'foo.yourcompany.com'). If you only SSH into servers you trust (a sensible practice) then the benefit is marginal.
Note that it does accept wildcards so you can do rules for *.mycompany.com You can also use placeholders for keys, so for example I have a ssh config like: Host *.mycompany.com # Employer specific yubikey stuff Host *.mydomain.com IdentityFile ~/.ssh/keys/id_primary Host * IdentitiesOnly yes IdentityFile ~/.ssh/keys/%r@%h # uses ~/.ssh/keys/git@github.com for github for example I originally started doing this because…
Host foo foo.example.com some.other.alias
Can you use this to id people for authentication? As in if someone pings your server and you get a key that matches their GitHub is it really that person's key or could they be doing it without having the corresponding private key?
Today I learned that GitHub keeps a publicly accessible list of all pubkeys linked to each user's account.
Ubuntu Server's installer allows you to import it as the authorized_keys for the new user.
ssh-import-id gh:$USERNAMEJust for those curious about it: $ ssh whoami.filippo.io +---------------------------------------------------------------------+ | | | _o/ Hello! | | | | | | Did you know that ssh sends all your public keys to any server | | it tries to authenticate to? You can see yours echoed below. | | | | We tried to use them to lookup your GitHub account, | | but got no match :( | | | | -- Filippo (https://filippo.io) | | | | |…
What, if any, are the downsides to this? Is it just as OP states in article, where you have to interact with the authentication process to provide a key (assuming no key is associated to host as you explain)?
That you trying to SSH into some random server doesn't know that you also use github?
Can you use this to id people for authentication? As in if someone pings your server and you get a key that matches their GitHub is it really that person's key or could they be doing it without having the corresponding private key?
Anyone can download the public key and impersonate that person in a scheme like this.