On: Why aren’t we using SSH for everything?

[kazinator]

SSH chat does not ensure that "I know who you claim to be". Only that "I know you're someone who has access to the same SSH key as that someone with whom I was talking yesterday".

In terms of authentication, that is about on par with an IRC "nickbot".

[arielb1 → kazinator]

There's nothing preventing you from transporting an SSH public key over some other secured channel. Then it's "I know that you are someone that has access to the SSH key transported over that secure channel".

[jessaustin → kazinator]

That's TOFU-POP, and it's perfectly reasonable for many situations. For example, HN.

[throwanem → jessaustin]

For others who've never before run into that particular acronym, it glosses per [1] to "Trust On First Use/Persistence of Pseudonym".

[1] https://lists.gnupg.org/pipermail/gnupg-devel/2014-March/028...