whoami.filippo.io
Security and privacy
ssh identity demo
SHOW HN2015
836points
245comments
#4of 2,565 in 2015
Top 1%of 2015 by points
How HN took it
MixedNo clear lean
20 positive, 48 neutral or asking, 1 mixed, 33 critical, out of 102 comments about the project. Thread score -0.13.
Privacy: 6 for, 12 againstExecution: 0 for, 17 againstIdea: 11 for, 4 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Clever, elegant demonstration of an overlooked SSH privacy issue
From 3 comments
I see most people acting like this was obvious but I gotta believe that a clear majority of ssh users had no idea about this. Yet it's extremely obvious when you think about it.…
INTPenis on HNThis is clever, and very sneaky! Let's say I downloaded every public key from GitHub to ~/.ssh. Would this identify me as everyone on GitHub, or just the owner of the first…
georgerobinson on HNI brought this attack up on reddit 3 years ago. http://www.reddit.com/r/crypto/comments/xf6pa/openssh_offers_your_public_keys_to_all_servers/ Glad to see someone implemented an…
ultramancool on HN
Useful awareness of key-sharing privacy
From 2 comments
It's a cool awareness experiment. Ultimately, public keys are public and people shouldn't be afraid of sharing them. Agent forwarding sharing is a big one though. Getting people…
jvehent on HNFound me; very nice. I wouldn't have guessed how you did it without the explanation about GitHub. I wonder if this means we should be rotating keys periodically? I know most…
pdq on HN
Objections
Public keys are meant to be public, so no real harm
From 3 comments
"Public keys" are supposed to be public anyway, isn't that what it's designed for? I see no harm
ernsheong on HNCripes, people. WHO CARES? So I SSHed in. I got the message. Then I saw all the people freaking out here and couldn't believe my eyes. Ask yourself this: How often do you SSH in…
Wisqnet on HNI don't see what's wrong with that.
drinchev on HN
Did not work for many users due to key setup
From 4 comments
Didn't work for me. Here's what I got. I cleaned out .ssh/knownhosts after connecting. ``` +---------------------------------------------------------------------+ | | | _o/…
acomjean on HNDidn't work for me, not because I don't have a Github key, but because I use separate keys for everything, and don't have a default key (requires plenty of ~/.ssh/config…
_wmd on HNIt didn't work for me even though I have a github account and ssh key installed from the same machine. Maybe related to the fact I use several keys and keychain to manage keys.
sp4ke on HNI use putty, this failed.
swah on HN
Requests
Clearer output or explanation when connection closes
From 3 comments
It just closes my connection. ``` root@paragonie:~# ssh whoami.filippo.io Connection to whoami.filippo.io closed. ``` I'm not sure what I'm supposed to be seeing.
sarciszewski on HNI simply got a "Connection to whoami.filippo.io closed."
vinceguidry on HNThe connection gets closed immediately for me, what is it supposed to do?
jonbwhite on HN
Way to disable GitHub publishing public keys
From 2 comments
Found me; very nice. I wouldn't have guessed how you did it without the explanation about GitHub. I wonder if this means we should be rotating keys periodically? I know most…
pdq on HNlike google analytics cookies track your every activity on every website, sending public keys feel the same way. now I have to re-evaluate my ssh usage after discovering ssh…
senthilnayagam on HN
Questions
How to avoid public key exposure via separate keys per host
From 3 comments
FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You…
chrisfosterelli on HNDouble-reading the man page I noticed that IdentitiesOnly makes ssh only send IdentityFile keys, however IdentityFile has a default of "~/.ssh/id_dsa, ~/.ssh/id_ecdsa,…
FiloSottile on HNDidn't work for me because I use a separate key for each "class" of machines, where class is github, bitbucket, work, home, ... You can reduce the maintenance load by using the…
emmelaich on HN
Alternatives named
Per-host SSH key config using IdentitiesOnly
From 2 comments
FYI, this happens because SSH automatically presents a public key to the server when trying to authenticate. If the server doesn't know that key, then SSH tries the next one. You…
chrisfosterelli on HNThere may be some people concerned with GitHub publishing their identity to everyone, but it is pretty easy to use a separate key for GitHub (they'll even generate it for you) if…
petrsnd on HN