12 ms·

By default SSH leaks all of the below public keys (if they exist) + all public keys in your ssh-agent to a server you connect to. ~/.ssh/id_ecdsa.pub ~/.ss

by h43z 2mo ago

By default SSH leaks all of the below public keys (if they exist) + all public keys in your ssh-agent to a server you connect to. ~/.ssh/id_ecdsa.pub ~/.ssh/id_ecdsa_sk.pub ~/.ssh/id_ed25519.pub ~/.ssh/id_ed25519_sk.pub ~/.ssh/id_xmss.pub ~/.ssh/id_dsa.pub running `ssh late.sh` would do exactly that. At the very bottom of the website they give you a command that would not leak your public keys. `ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh` this would only send the late_throwaway public key

Zambyte 2mo ago
Okay, but why is that something to be concerned about? How would one be able to probe to see if a server recognizes a public key? Why does that matter?
- nntlol 2mo ago
  [dead]
- prodigycorp 2mo ago
  so, i used my public key. can someone please tell me what i should be worried about now?
  - h43z 2mo ago
    If I have your public key I could probe a server to see if it recognizes that public key. Which would tell me information you might not want to be leaked.
    - Hugsbox 2mo ago
      Could you explain how/why that would be an issue? I still don't understand. Isn't the nature of public keys meant to be that they're public?
      - dmux 2mo ago
        I think what the other comment is getting at is that you're essentially leaving footprints behind on various servers and that information could be used to narrow down who you are, where you work, etc. For example, if you used the same key pair for a work machine at the big social media site example.com as you did late.sh, they could probe example.com's machine and see that you'd been there.
        Hugsbox 2mo ago
        That sounds like the kind of edge-case thing that wouldn't be even slightly a problem for like 99.9% of people.
        itsbczurstupid 2mo ago
        [flagged]
  - ErroneousBosh 2mo ago
    l33t h4xx0r5
  - plaidwombat 2mo ago
    All your base are belong to us. We recommend rotating keys more often than never.
  - stevekemp 2mo ago
    Github has public keys available, so the server owner could compare the key you sent to those - and that would identify your github username. Whether that's a concern or not is an open question, of course.

by h43z 2mo ago

Zambyte 2mo ago

Okay, but why is that something to be concerned about? How would one be able to probe to see if a server recognizes a public key? Why does that matter?

nntlol 2mo ago
[dead]
prodigycorp 2mo ago
so, i used my public key. can someone please tell me what i should be worried about now?
- h43z 2mo ago
  If I have your public key I could probe a server to see if it recognizes that public key. Which would tell me information you might not want to be leaked.
  - Hugsbox 2mo ago
    Could you explain how/why that would be an issue? I still don't understand. Isn't the nature of public keys meant to be that they're public?
    - dmux 2mo ago
      I think what the other comment is getting at is that you're essentially leaving footprints behind on various servers and that information could be used to narrow down who you are, where you work, etc. For example, if you used the same key pair for a work machine at the big social media site example.com as you did late.sh, they could probe example.com's machine and see that you'd been there.
      - Hugsbox 2mo ago
        That sounds like the kind of edge-case thing that wouldn't be even slightly a problem for like 99.9% of people.
        itsbczurstupid 2mo ago
        [flagged]
- ErroneousBosh 2mo ago
  l33t h4xx0r5
- plaidwombat 2mo ago
  All your base are belong to us. We recommend rotating keys more often than never.
- stevekemp 2mo ago
  Github has public keys available, so the server owner could compare the key you sent to those - and that would identify your github username. Whether that's a concern or not is an open question, of course.