Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ssh whoami.filippo.io

words.filippo.io

Post reply on HN
Print view View original

81–90 of 90 posts

Re: ssh whoami.filippo.io

#81

Post by quickthrower2 »

Waterluvian wrote: post #19

The idea of walking up to a lock and saying “here are all of my keys. Do any unlock you?” is kind of weird and backwards. But I realize, thinking about it, I was doing that all the time at a previous job where I’d just mash my entire wallet against the keycard reader. Bonus tangent: join me in playing “Payment Roulette” where you mash your wallet against payment terminals and let your credit and debit cards sort out…

Not quite because there is no public/private key analogy. With a physical key there isn’t much security and you are relying on the copying of the key (if someone takes a photo) not happening. There would need to be some sophistication and anyone that sophisticated wouldn’t need to burglarise you. And it is that fact you rely on for a key. It is almost like a credit card PIN

Re: ssh whoami.filippo.io

#82

Post by arjvik »

notpushkin wrote: post #70
vkoskiv wrote: post #66

Earlier quoted context omitted.

Anyone can download the public key and impersonate that person in a scheme like this.

Unless you require them to authenticate using that key (which would obviously require them to have the private key on hand).

What you are describing is the current status quo

Re: ssh whoami.filippo.io

#85

Post by j1elo »

Macha wrote: post #34
rjh29 wrote: post #28

Earlier quoted context omitted.

The downside is that if you use a large range of servers, you will have to configure them to tell SSH what identities to use. This can be cumbersome if you ssh by alias (e.g. 'foo' rather than 'foo.yourcompany.com'). If you only SSH into servers you trust (a sensible practice) then the benefit is marginal.

Note that it does accept wildcards so you can do rules for *.mycompany.com You can also use placeholders for keys, so for example I have a ssh config like: Host *.mycompany.com # Employer specific yubikey stuff Host *.mydomain.com IdentityFile ~/.ssh/keys/id_primary Host * IdentitiesOnly yes IdentityFile ~/.ssh/keys/%r@%h # uses ~/.ssh/keys/git@github.com for github for example I originally started doing this because…

Yes that's exactly what I do. I just left it as an "exercise for the reader" to not make the comment too long :)

This kind of stuff is also useful, for example, for AWS machines:

  Host ec2-*.compute-1.amazonaws.com
      # KeepAlive of 50 seconds, because AWS times out after 60:
      # https://aws.amazon.com/blogs/aws/elb-idle-timeout-control/
      ServerAliveInterval 50

Re: ssh whoami.filippo.io

#86

Post by kevincox »

TechBro8615 wrote: post #49
boarnoah wrote: post #44

Earlier quoted context omitted.

Seems questionable on Github's part to have .keys public by default, why not allow people to opt in ex: keybase.io equivalent? Yes I get that its not sensitive information, but as this demo demonstrates it can fingerprint people who might not be unaware re: this quirk of SSH's coupled with this part of the Github API.

If you are SSH'ing into a server you should expect to get fingerprinted.

There is a bug difference between being fingerprinted by the server that I am trying to log into and sharing (part of) gbag fingerprint publicly.

Re: ssh whoami.filippo.io

#87

Post by newaccount74 »

netsharc wrote: post #37
Waterluvian wrote: post #19

The idea of walking up to a lock and saying “here are all of my keys. Do any unlock you?” is kind of weird and backwards. But I realize, thinking about it, I was doing that all the time at a previous job where I’d just mash my entire wallet against the keycard reader. Bonus tangent: join me in playing “Payment Roulette” where you mash your wallet against payment terminals and let your credit and debit cards sort out…

A lot of times the machine would say "Use one card only", won't it? I have a Secrid wallet and I was expecting the aluminium to block the RFID reader except for the 1 card I put in the outer leather pocket, but I still need to open the wallet up and present the dangling card in its sleeve to stop multiple signals...

Blocking radio signals is harder than just adding some aluminium. I'm pretty sure most "RFID blocking" wallets don't actually block RFID reliably.

Re: ssh whoami.filippo.io

#88

Post by WirelessGigabit »

krab wrote: post #68
mynameisvlad wrote: post #23

Earlier quoted context omitted.

Ubuntu Server's installer allows you to import it as the authorized_keys for the new user.

Cloud-init as well. The CLI utility you can use is ssh-import-id. ssh-import-id gh:$USERNAME

Which is the tool that Ubuntu uses!

Re: ssh whoami.filippo.io

#89

Post by basilgohar »

laurensr wrote: post #84

So users can add other users' SSH keys (sourced from GitLab, ....) to their GitHub profile, essentially depriving the actual key owner from using GitHub

But then that opens them up to having their victim commit code to their repos directly, as well.

Re: ssh whoami.filippo.io

#90

Post by yencabulator »

basilgohar wrote: post #89
laurensr wrote: post #84

So users can add other users' SSH keys (sourced from GitLab, ....) to their GitHub profile, essentially depriving the actual key owner from using GitHub

But then that opens them up to having their victim commit code to their repos directly, as well.

Not a big deal for an attacker to create a dummy account.
Post reply on HN