Hacker News Reader

So how does this work behind the scenes?

Does the user have to trust the service provider, and can the service provider conceivably distribute malware or take control of the user's machine through this tool?

View on HN

Cool question actually. We don’t terminate SSH, the server is used to distribute trust, so while technically possible that this could change, or there is some attack vector we did not think of, the implementation is careful to avoid that.

What do you mean by "distribute trust"?

Exchange trusted ssh CA public keys

Reply on news.ycombinator.com