ssh whoami.filippo.io

#1

Post by exists » Sun, Jan 08, 2023, 6:40 PM UTC

ssh whoami.filippo.io
words.filippo.io

Re: ssh whoami.filippo.io

#2

Post by Normille » Sun, Jan 08, 2023, 9:17 PM UTC

I don't know whether this is clever or not. But it ID'd me from my Github account public keys.

Re: ssh whoami.filippo.io

#3

Post by woodruffw » Sun, Jan 08, 2023, 10:35 PM UTC

Normille wrote: post #2

I don't know whether this is clever or not. But it ID'd me from my Github account public keys.

I think it's pretty clever, and demonstrates something very powerful about GitHub's position as de facto global code repository: you can get a strong cryptographic identity for (almost) anyone on the service, which you can then sign/encrypt to, verify for, etc.

age (another tool of Filippo's) leverages this to make encrypting to any GitHub user easy[1].

[1]: https://github.com/FiloSottile/age#encrypting-to-a-github-us...

Re: ssh whoami.filippo.io

#4

Post by [deleted] » Sun, Jan 08, 2023, 10:54 PM UTC

[deleted]

Re: ssh whoami.filippo.io

#5

Post by tcard » Sun, Jan 08, 2023, 10:55 PM UTC

woodruffw wrote: post #3

Normille wrote: post #2

I don't know whether this is clever or not. But it ID'd me from my Github account public keys.

I think it's pretty clever, and demonstrates something very powerful about GitHub's position as de facto global code repository: you can get a strong cryptographic identity for (almost) anyone on the service, which you can then sign/encrypt to, verify for, etc. age (another tool of Filippo's) leverages this to make encrypting to any GitHub user easy[1]. [1]: https://github.com/FiloSottile/age#encrypting-to-a-github-u…

> you can get a strong cryptographic identity for (almost) anyone on the service, which you can then sign/encrypt to, verify for, etc.

I made https://sshign.tcardenas.me/ to take advantage of this. For example: [1]

In the end, it isn't that useful. I only routinely sign digitally to deal with the (Spanish) government, and they provide their own certificates and software to do that.

[1] https://sshign.tcardenas.me/?signer=github.com%2Ftcard&messa...

Re: ssh whoami.filippo.io

#6

Post by bhaney » Sun, Jan 08, 2023, 11:14 PM UTC

  $ ssh whoami.filippo.io
  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  @       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  The ED25519 host key for whoami.filippo.io has changed

I guess I've tried this before

Re: ssh whoami.filippo.io

#7

Post by o_____________o » Sun, Jan 08, 2023, 11:19 PM UTC

You can turn this behavior off in .ssh/config with

  Host *
    PubkeyAuthentication no

Put that at the bottom of the file, then turn back on for each host:

  Host site.com
    PubkeyAuthentication yes

Re: ssh whoami.filippo.io

#8

Post by andrewstuart » Sun, Jan 08, 2023, 11:28 PM UTC

[flagged]

Re: ssh whoami.filippo.io

#9

Post by frutiger » Sun, Jan 08, 2023, 11:31 PM UTC

andrewstuart wrote: post #8

[flagged]

> lifts your public keys.

That's why they're called "public".

Re: ssh whoami.filippo.io

#10

Post by frutiger » Sun, Jan 08, 2023, 11:34 PM UTC

Normille wrote: post #2

I don't know whether this is clever or not. But it ID'd me from my Github account public keys.

As a side note public keys are available on GitHub, e.g. https://github.com/FiloSottile.keys.