Hacker News Reader

You don't have to distribute fingerprints by hand. SSH already has a built-in PKI that handles this, and it's what most large fleet operators use (it's also the simplest way to connect an SSH fleet to an SSO IdP). SSH certificates, not WebPKI certificates.

View on HN

> You don't have to distribute fingerprints by hand. SSH already has a built-in PKI that handles this, and it's what most large fleet operators use (it's also the simplest way to connect an SSH fleet to an SSO IdP). SSH certificates, not WebPKI certificates.

I know. I'm discussing them in my post.

If you're replying on posts without reading them in their entirety, that certainly explains some of the communication issues we were having on another post (re. DANE) a while back. I don't think I'm interested in any further exchange with you.

I read your whole post, which ended with "if users copy around fingerprints", which is a problem the built-in SSH PKI that large fleet operators already use solves. I don't think I misconstrued you.

You don't have to keep replying, but I'm going to point out that we have gotten no closer to finding a reason that anyone would even entertain the idea of SSHFP, a system that wires the already perfectly good SSH PKI subsystem into the state-controlled DNS PKI. Why would anybody ever do that?

Reply on news.ycombinator.com