Hacker News Reader

Comment by 0942v8653 | Hacker News Reader

Careful when SSHing into an untrusted host. They can find your public key(s) that way and maybe identify who you are on GitHub.

View on HN

What are some good ways to protect against that?

My first thought is to create an entry in my ~/.ssh/config with an entry for the untrusted host I'm going to ssh in to, using the "IdentityFile" keyword to point to some bogus/misleading identity file. How does that sound?

A simple solution would be to create a dummy account and use that for sshing into untrusted hosts.

I wonder if you can turn off automatic use of public keys for "*", and then enable it in .ssh/config on an as-needed basis.

Totally possible, I do this. Also I have a different key per host (using %h in IdentityFile)

Do you use pass-phrases with your per-host keys? I wanted to do this, but was unable to make it manageable. ssh-agent will only try so many keys before moving on.

No, I don't use key pass-phrases.

Just use a different key for github than for everything else. You can specify this in your ssh config using the IdentityFile directive.

In your .ssh/config file:

    Host *
    # Do not send pubkey to each and any host
    PubkeyAuthentication no
    # Use Agent
    IdentitiesOnly       yes

Then override 'PubkeyAuthentication' to yes for each known server you want to connect to.

I don't understand, why is that a bad thing? Maybe it might be an issue if you're trying to do something anonymously (but at that point, you shouldn't be using your regular machine anyway).

It's not, it's a "public" key.

It's not a problem from security perspective. It is a problem from privacy perspective.

Privacy is security.

"Security is the degree of resistance to, or protection from, harm."

"Privacy: a secret matter."

"Privacy: freedom from unauthorized intrusion."

"Privacy: the quality or state of being apart from company or observation."

So you see, privacy IS security.

I can't tell if you forgot /s?

> It's not, it's a "public" key

Not just any public key, it's your public key. It identifies you.

It's rather unexpected. Browsers carry so much baggage that you need a private mode, I wouldn't have expected something like ssh to have this sort of problem before I read about how it exposes your keys.

If your identity is that sensitive keep a standard public key that is used by default, but for services where you might want your identity to not be linked to other accounts/places/activities have a separate key for each and specified where to use it in you SSH config (or by naming with the -i parameter on each ssh call).

I could be more worried about a modified sshd, that triggers different code paths in the client than the expected ones.

Why would that be a problem?

Reply on news.ycombinator.com