Hacker News new | past | comments | ask | show | jobs | submit login

Publishing the public key that you use to push to github/gitlab is not a big issue... But Re-using your github key-pair, to connect to other unknown and uncontrolled places, _is_ a security issue.

Even re-using your daily system user, for this, is a security issue.

But if you never did read the sshd_config man page, or never did play with its options, maybe you're unaware of this.

Also the sshd could be modified at source level.




Can you explain how this could be exploited (assuming that the user does not ignore warnings)?


I'm not sure if it is a big issue without passing in -A to allow forwarding of authentication to a second server beyond the one you're logging in to. In theory you should still be in control of your secret key and the session even if the first server attempts to proxy or steal your private key. Note that your console/tty or shell might be vulnerable to a malicious server in any case.

Stuff like:

https://m.theregister.co.uk/2016/01/14/openssh_is_wide_open_...

seem to indicate that a patched ssh client should (no longer) leak private keys without the -A parameter...




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: