Hacker News Reader

Comment by Someone1234 | Hacker News Reader

Maybe GitHub themselves should just stop accepting keys of a certain length. For example <2048 RSA keys (and <256 ECDSA keys). They could also check against the Debian set.

As the article says, GitHub could be being proactive rather than reactive here. They don't "have" to, but they could.

View on HN

GitHub now, after reporting this to them do not allow keys below 1023 to be added, and all keys that had been smaller than that, have been removed and owners of those keys got a email like screenshot on the top of the post

According to a 2009 blog post[1]:

> Thanks to our new servers, known bad keys[2] from Debian and Ubuntu are now blacklisted. We estimate that about 1000 keys in our database were impacted by this. If you get authentication errors using keys that worked a day ago, please double-check that they are not on our blacklist. If they are, you should ensure your software is updated and generate new keys. We’ve got a guide to help you out with this.

[1] https://github.com/blog/500-state-of-the-hub-rackspace-day-0

[2] https://github.com/blog/63-ssh-keys-generated-on-debian-ubun...

Woah, this new article says a lot of weak-Debian keys were found. Does this mean Github had a regression in their blacklisting since 2009? Or maybe they didn't blacklist enough originally?

Or the list used contained keys that weren't actually weak debian keys?

Actually the facts are not incompatible here. There are two questions: Are weak Debian keys accepted in the web app? Are weak Debian keys accepted by their SSH.

The answers were yes and no. It's the same for most systems right now. You can put a weak Debian key in authorised keys, but you won't be able to login anyway.

Reply on news.ycombinator.com