Hacker News Reader

Comment by jvehent | Hacker News Reader

> Why aren’t we using SSH for everything?

Because when you have 100,000 users and you need to rotate your host key following a leak, the team in charge of user retention has a heart attack.

View on HN

Informing users when your keys were leaked is more important than user retention. Hiding your weaknesses does not build trust.

You're missing the point: SSH does not provide a host key rotation/revocation mechanism. TLS does.

You said that you are afraid of loosing users after a leak, which implies if you don't have to, you won't tell your users about the incident.

No, its that the fix is client side and painful. They can tell their users to fix it and they would rather leave than do it.

I thought users would be prompted to accept a new fingerprint. Am I missing something?

If by "prompted" you mean:

@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ IT IS POSSIBLE THAT SOMONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now!

Then, yes, users will be prompted in the scariest possible language.

Compare this with HTTPS/browsers, which care not a lick if a certificate/fingerprint is different, provided that the certificate is valid and the chain is trusted.

Which --coincidentally-- is exactly the problem with it.

No. I said that changing the key, which must happen, will trigger a warning that will scare users away. Which is (partly) why no one uses SSH with non technical populations.

You can use cert signed keys with ssh.

It does provide host key rotation in OpenSSH 6.8+: http://blog.djm.net.au/2015/02/key-rotation-in-openssh-68.ht...

This technique assumes the operator is OK with taking a few weeks for all users to register the new host key. In the event of a leak, revocation of the leaked key must be immediate. That's why we have CRLs (and OneCRL) and OCSP.

More important to the users probably, or at least it should be. Not remotely close to more important to the investors.

I certainly agree with you that I would like things to be this way, to live in that world with you. But we don't.

Reply on news.ycombinator.com