Hacker News Reader

Comment by gregschlom | Hacker News Reader

> Death of the SSH key. People should be able to connect to GitHub with their GitHub username and password.

This sounds like a wrong design decision. I wish nobody could log into my github account using anything but my SSH keys.

This is also true of my AWS account: my ec2 instances are protected by SSH keypairs, but if anyone gets my AWS password, he has full control over everything.

I'm not a security expert, but SSH keys feel way safer than passwords, especially with all those recents article showing how easy it can be to bruteforce passwords.

View on HN

Holy crap, yes. This was incredibly alarming. SSH keys are far and away more secure than username/password. I would be far more comfortable if it were possible to use GitHub with nothing but my SSH key. The ability to create a passcode-secured key is vital to me, because the keys and the passcodes have to be stolen to be useful at all.

And if you use ssh-agent, I'm pretty sure it doesn't even send your private key; SSH creates a challenge that your key is used to compute, so even someone eavesdropping with a keylogger on the server won't be able to sniff your password.

Not sending your private key inherent property of public-key authentication, and is used in all instances of SSH key-based authentication. ssh-agent is merely convenient "keyring" type application so you do not have to continually re-enter the passwords for the on disk encrypted private key files. (You are encrypting your ssh keys with a password right?)

Since GitHub launched, you've been able to access your repositories via username/password (and add/remove ssh keys via the web interface). But remember — we're talking about client security.

If someone steals/owns your personal machine it's actually much easier to gain access to SSH Keys than find your username/password (since an alarming number of people use passwordless ssh keys).

Aside from that though — SSH Keys are probably the biggest barrier to people being able to use and contribute with GitHub.

>(since an alarming number of people use passwordless ssh keys).

Then I'll amend gregschlom's comment to further say I wish passwordless ssh keys did not exist.

> SSH Keys are probably the biggest barrier to people being able to use and contribute with GitHub

The barrier to entry of writing software doesn't need to be zero. If a person is going to write code, they should also learn some of the basic tools of the trade.

And I'd claim that an SSH key isn't one of them. There is only one platform (UNIX-based web applications with application servers) that actually benefits from them, and plenty that don't (Android, iOS, Mac desktop, Win32, this week's .NET desktop stuff, ASP-of-the-week, Windows Phone 7).

As a company that makes money from users, it's to GitHub's benefit to make it easy to use their stuff.

I use SSH keys to log into Linux and OS X boxes all the time, servers and otherwise. And boy have I wished there was an easy SSH server to run on Windows.

You have to log into remote boxes these days and SSH keys are the best way to do that.

(Until 1password gets iTerm2 integration anyway, but the 1password guys don't seem receptive to that idea)

I think their goal was to make GitHub (and by extension git itself) more accessible to people who code, but are not familiar/comfortable enough with command line Unix or SSH to generate SSH keypairs. There are a lot of these people.

Although I agree that SSH keypairs feel more secure than a username/password, it would make setting up a new machine for development a lot easier than generating a new SSH keypair and adding it to my GitHub (or any other git server) account.

Couldn't the app use your username / password to connect to github the first time and then generate an SSH key pair which it would use from that point forward?

That seems like the best compromise of security and easy of use to me.

Then the client would only work easily with Github. That would be very sad for those of us who deploy Git repos on other servers than Github.

As it is, I'm pretty sure this is using standard HTTPS auth with Git, which is not that hard to support.

The client works fine with other Git servers, and uses your standard SSH keys.

"Death to the SSH key" applies only to GitHub interactions — getting a list of your repos, for example.

The new GitHub API actually supports Git operations authenticated via OAuth. Just throwing that out there.

This is why UI guys should not be responsible for security decisions.

Reply on news.ycombinator.com