Obtain a GitHub user's public keys
github.com
Obtain a GitHub user's public keys
1–10 of 31 posts
Re: Obtain a GitHub user's public keys
#2Found out about this today, you can prepend any GitHub username with .keys to fetch their public keys.
Re: Obtain a GitHub user's public keys
#3Found out about this today, you can prepend any GitHub username with .keys to fetch their public keys.
What can this be used for? I'd love to display my GPG key there instead but I guess that's not possible.
Re: Obtain a GitHub user's public keys
#4Re: Obtain a GitHub user's public keys
#5I use it to set user access to my company's servers with ansible automatically. I just have to set a list of github usernames and it generates a list of users with their ssh key access setup !
Re: Obtain a GitHub user's public keys
#6It's worth noting that this shows only "verified" keys, which are keys that have been added to the account and used at least once.
Re: Obtain a GitHub user's public keys
#7I use it to set user access to my company's servers with ansible automatically. I just have to set a list of github usernames and it generates a list of users with their ssh key access setup !
[deleted]
Re: Obtain a GitHub user's public keys
#8I use it to set user access to my company's servers with ansible automatically. I just have to set a list of github usernames and it generates a list of users with their ssh key access setup !
[deleted]
If someone hacked GitHub they'd just get the _public_ keys, same as the ones listed in the link. You can't login on a server with the public key.
What he has done is that by adding github ids, he gets the public keys of all the users and adds them to his servers. Now all the users' public keys are already in the system. Now they can login with their private keys and this private key remains _only_ on their own system. Not on GitHub or server.
Re: Obtain a GitHub user's public keys
#9Earlier quoted context omitted.
[deleted]
If someone hacked GitHub they'd just get the _public_ keys, same as the ones listed in the link. You can't login on a server with the public key. What he has done is that by adding github ids, he gets the public keys of all the users and adds them to his servers. Now all the users' public keys are already in the system. Now they can login with their private keys and this private key remains _only_ on their own system…
If someone hacked github, they could substitute their own evil key for one of the developers' keys and the automation would add that key to appropriate places, giving access to whomever has the evil private key.
On the other hand, OP probably trusts the contents of source repositories stored on github (few people use commit and tag signing); if so he already trusts github with everything.