Hacker News Reader

Comment by rcarmo | Hacker News Reader

Yeah, I don't like this approach either. There was a lot of plumbing added to sshd to support pluggable auth methods, and having used a few of them (including TOTP, for instance), I am not really a fan of "extending" publickey.

(Am also not really a fan of having to eventually use a browser for authenticating a terminal session, but that's another problem.)

View on HN

> (Am also not really a fan of having to eventually use a browser for authenticating a terminal session, but that's another problem.)

That sounds awful, I hope this is not the direction we are heading towards.

You can actually have a fully command-line driven Single Sign-On workflow, even anchored in hardware (TouchID, FIDO tokens, etc.)

It's not a common way to do it, but it's definitely a possibility.

Like Yubikeys? I've always wanted to get one. My workflow does not require a browser though, thankfully.

It happens when there's a cloudflared instance. It is quite annoying

That is insane to me. It really requires a browser for a terminal session? No alternatives? Why does it require a browser?

IDK if there was an alternative. But that's how it worked at a previous employer. You'd ssh, a tab would open in your browser, and you'd need to approve the connection. But this doc I found suggests that's my experience is just how it works (very end)[0]. But note that it says legacy (it did not previously when I was using it)

[0] https://developers.cloudflare.com/cloudflare-one/connections...

not just a browser - but coupled with the javascript-as-an-operatingsystem which first assumes you are a bot, but then you prove to it that you are not. lol

They reject the proofs now: they just show the spinner spinning indefinitely now. CloudFlare is broken and it has widespread so much that it looks like a cancer.

I just get a red circle with a white line across it (a "no entry" traffic sign) and some message paraphrased as "You are a bot, now fuck off, bot."

Reply on news.ycombinator.com