4 ms·

Obtain a GitHub user's public keys

57 points by kentwistle 12y ago

kentwistle 12y ago
Found out about this today, you can prepend any GitHub username with .keys to fetch their public keys.
- voltagex_ 12y ago
  What can this be used for? I'd love to display my GPG key there instead but I guess that's not possible.
  - riffraff 12y ago
    as an alternative to ssh-copy-id ?
    - andreaso 12y ago
      Yepp, and there is already an existing tool, which currently supports GitHub as well as Launchpad. http://manpages.ubuntu.com/manpages/trusty/en/man1/ssh-import-id.1.html http://manpages.ubuntu.com/manpages/trusty/en/man1/ssh-impor... https://launchpad.net/ssh-import-id https://launchpad.net/ssh-import-id
  - stedaniels 12y ago
    Have you seen https://keybase.io/ https://keybase.io/ that's an ideal place for your GPG keys (and more) :-)
    - peterhajas 12y ago
      I can't tell if it's finished yet: > Keybase will be a public directory of publicly auditable public keys. Nor do I understand why I'd use it. Do lots of people post GPG encrypted messages to each other on gist?
      - mseebach 12y ago
        It's an attempt to solve the key distribution problem. By having you verify your keys on third party sites, a MITM or NSL attack (providing you with fake keys so your messages can be intercepted) gets a lot harder as you have to attack n sites simultaneously instead of one.
- joe_inferno 12y ago
  you mean you can append any GitHub username
robinricard 12y ago
I use it to set user access to my company's servers with ansible automatically. I just have to set a list of github usernames and it generates a list of users with their ssh key access setup !
- deleted 12y ago
  [deleted]
  - leostatic 12y ago
    If someone hacked GitHub they'd just get the _public_ keys, same as the ones listed in the link. You can't login on a server with the public key. What he has done is that by adding github ids, he gets the public keys of all the users and adds them to his servers. Now all the users' public keys are already in the system. Now they can login with their private keys and this private key remains _only_ on their own system. Not on GitHub or server.
    - robryk 12y ago
      If someone hacked github, they could substitute their own evil key for one of the developers' keys and the automation would add that key to appropriate places, giving access to whomever has the evil private key. On the other hand, OP probably trusts the contents of source repositories stored on github (few people use commit and tag signing); if so he already trusts github with everything.
      - mitchty 12y ago
        It really depends upon if the git repo is gpg signed. We really don't know enough about the automation to make any assumptions. Were I to do it I would require gpg signed commits and setup the trust chain a bit differently. But you're right its likely just a list of git repos that aren't signed.
        robryk 12y ago
        Signing of the repo contents (commits/tags) doesn't help anyhow with user ssh keys. If the automation gets the keys from github it effectively trusts github completely, irrespective of the situation with repos.
akerl_ 12y ago
It's worth noting that this shows only "verified" keys, which are keys that have been added to the account and used at least once.
drunken_thor 12y ago
I am glad my email doesn't show up in there.
- AYBABTME 12y ago
  It does: https://github.com/aybabtme/gol/commit/37ebaf91f312705e0f96f3196ded5f7fb925c680.patch https://github.com/aybabtme/gol/commit/37ebaf91f312705e0f96f...
intull 12y ago
Is this supposed to be okay? I mean, even though they are public keys, its not like I really want them to be _that_ public!
- octo_t 12y ago
  Whats the harm? At most, people can encrypt things with your public key and then...?
  - thu 12y ago
    I'd say that at most it forces you a bit more (if that was necessary) to check the SSH fingerprint of the machines you're SSHing into.
  - stared 12y ago
    For example they can identify my different accounts, when I sue the same key.
    - automatthew 12y ago
      Last time I tried to use the same public key for a second account, GitHub refused.
- Perseids 12y ago
  I also view this as information leakage. I keep some of my online pseudonyms completely separated, and stuff like that allows people to link them together, if I was not careful enough to use a separate ssh key.
mixologic 12y ago
Seems like this would be a good way to frame somebody else. Hack into a server, do some damage/steal files, and drop somebody elses public key on the server. "But I didnt do it!" - Then why was your key on the server?
- kordless 12y ago
  Because public keys are somewhat publicly available information?
rlpb 12y ago
Something similar has been available on Launchpad for years. There's a tool called "ssh-import-id". If I want to give you access to an Ubuntu server, I might type "ssh-import-id kentwistle". This would fetch public keys that the kentwistle user on Launchpad has published over HTTPS and then add them to ~/.ssh/authorized_keys. I don't think there's any reason that ssh-import-id needs to be Launchpad-specific.
lloeki 12y ago
Github leverages such content-type negotiation for other resources too: add .diff or .patch to commits or pull requests. There's a way to get git am compatible data too.

57 points by kentwistle 12y ago

kentwistle 12y ago

Found out about this today, you can prepend any GitHub username with .keys to fetch their public keys.

voltagex_ 12y ago
What can this be used for? I'd love to display my GPG key there instead but I guess that's not possible.
- riffraff 12y ago
  as an alternative to ssh-copy-id ?
  - andreaso 12y ago
    Yepp, and there is already an existing tool, which currently supports GitHub as well as Launchpad. http://manpages.ubuntu.com/manpages/trusty/en/man1/ssh-import-id.1.html http://manpages.ubuntu.com/manpages/trusty/en/man1/ssh-impor... https://launchpad.net/ssh-import-id https://launchpad.net/ssh-import-id
- stedaniels 12y ago
  Have you seen https://keybase.io/ https://keybase.io/ that's an ideal place for your GPG keys (and more) :-)
  - peterhajas 12y ago
    I can't tell if it's finished yet: > Keybase will be a public directory of publicly auditable public keys. Nor do I understand why I'd use it. Do lots of people post GPG encrypted messages to each other on gist?
    - mseebach 12y ago
      It's an attempt to solve the key distribution problem. By having you verify your keys on third party sites, a MITM or NSL attack (providing you with fake keys so your messages can be intercepted) gets a lot harder as you have to attack n sites simultaneously instead of one.
joe_inferno 12y ago
you mean you can append any GitHub username

robinricard 12y ago

I use it to set user access to my company's servers with ansible automatically. I just have to set a list of github usernames and it generates a list of users with their ssh key access setup !

deleted 12y ago
[deleted]
- leostatic 12y ago
  If someone hacked GitHub they'd just get the _public_ keys, same as the ones listed in the link. You can't login on a server with the public key. What he has done is that by adding github ids, he gets the public keys of all the users and adds them to his servers. Now all the users' public keys are already in the system. Now they can login with their private keys and this private key remains _only_ on their own system. Not on GitHub or server.
  - robryk 12y ago
    If someone hacked github, they could substitute their own evil key for one of the developers' keys and the automation would add that key to appropriate places, giving access to whomever has the evil private key. On the other hand, OP probably trusts the contents of source repositories stored on github (few people use commit and tag signing); if so he already trusts github with everything.
    - mitchty 12y ago
      It really depends upon if the git repo is gpg signed. We really don't know enough about the automation to make any assumptions. Were I to do it I would require gpg signed commits and setup the trust chain a bit differently. But you're right its likely just a list of git repos that aren't signed.
      - robryk 12y ago
        Signing of the repo contents (commits/tags) doesn't help anyhow with user ssh keys. If the automation gets the keys from github it effectively trusts github completely, irrespective of the situation with repos.

akerl_ 12y ago

It's worth noting that this shows only "verified" keys, which are keys that have been added to the account and used at least once.

drunken_thor 12y ago

I am glad my email doesn't show up in there.

AYBABTME 12y ago
It does: https://github.com/aybabtme/gol/commit/37ebaf91f312705e0f96f3196ded5f7fb925c680.patch https://github.com/aybabtme/gol/commit/37ebaf91f312705e0f96f...

intull 12y ago

Is this supposed to be okay? I mean, even though they are public keys, its not like I really want them to be _that_ public!

octo_t 12y ago
Whats the harm? At most, people can encrypt things with your public key and then...?
- thu 12y ago
  I'd say that at most it forces you a bit more (if that was necessary) to check the SSH fingerprint of the machines you're SSHing into.
- stared 12y ago
  For example they can identify my different accounts, when I sue the same key.
  - automatthew 12y ago
    Last time I tried to use the same public key for a second account, GitHub refused.
Perseids 12y ago
I also view this as information leakage. I keep some of my online pseudonyms completely separated, and stuff like that allows people to link them together, if I was not careful enough to use a separate ssh key.

mixologic 12y ago

Seems like this would be a good way to frame somebody else. Hack into a server, do some damage/steal files, and drop somebody elses public key on the server. "But I didnt do it!" - Then why was your key on the server?

kordless 12y ago
Because public keys are somewhat publicly available information?

rlpb 12y ago

Something similar has been available on Launchpad for years. There's a tool called "ssh-import-id". If I want to give you access to an Ubuntu server, I might type "ssh-import-id kentwistle". This would fetch public keys that the kentwistle user on Launchpad has published over HTTPS and then add them to ~/.ssh/authorized_keys. I don't think there's any reason that ssh-import-id needs to be Launchpad-specific.

lloeki 12y ago

Github leverages such content-type negotiation for other resources too: add .diff or .patch to commits or pull requests. There's a way to get git am compatible data too.