new | ask | show | jobs
h43z 13 hours ago  [ - ]

Reminder to be cautious about leaking public keys.

Once you leak your public key it could be used to check if another server recognizes that leaked public key.

alentred 11 hours ago  [ - ]

Did I miss something? Aren't public key are supposed to be public?

To be clear, that's an honest question, not sarcasm of anything. I only assume I don't know about some corner case with SSH or something? Because we have those on our websites, they are supposed to be used to verify signatures, etc. How is publishing them bad?

h43z 10 hours ago  [ - ]

It's just something everyone should be aware of.

It's up to you to decide if it's okay that you send a server provider (in this case late.sh) a bunch of your public keys which he could for example use to probe other servers to see if you have access to them.

Everyone has different opsec.

drabbiticus 9 hours ago  [ - ]

The site does include a way to use a throwaway key and IIRC it was there last night too.

    ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh
Based on what another user said, you might want to modify the above command to use throwawayUsername@late.sh instead if you are going the throwaway route to be more certain you aren't leaking your OS username.
benj111 12 hours ago  [ - ]

Surely you shouldn't be leaking your username. I could use it to see if another server recognised 'h43z'....

h43z 11 hours ago  [ - ]

OpenSSH server is designed not to reveal whether a username exists.

Zambyte 13 hours ago  [ - ]

What?

h43z 12 hours ago  [ - ]

By default SSH leaks all of the below public keys (if they exist) + all public keys in your ssh-agent to a server you connect to.

  ~/.ssh/id_ecdsa.pub
  ~/.ssh/id_ecdsa_sk.pub
  ~/.ssh/id_ed25519.pub
  ~/.ssh/id_ed25519_sk.pub
  ~/.ssh/id_xmss.pub
  ~/.ssh/id_dsa.pub
running `ssh late.sh` would do exactly that.

At the very bottom of the website they give you a command that would not leak your public keys.

`ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh`

this would only send the late_throwaway public key

Zambyte 12 hours ago  [ - ]

Okay, but why is that something to be concerned about? How would one be able to probe to see if a server recognizes a public key? Why does that matter?

prodigycorp 12 hours ago  [ - ]

so, i used my public key. can someone please tell me what i should be worried about now?

stevekemp 7 hours ago  [ - ]

Github has public keys available, so the server owner could compare the key you sent to those - and that would identify your github username.

Whether that's a concern or not is an open question, of course.

h43z 12 hours ago  [ - ]

If I have your public key I could probe a server to see if it recognizes that public key. Which would tell me information you might not want to be leaked.

Hugsbox 8 hours ago  [ - ]

Could you explain how/why that would be an issue? I still don't understand. Isn't the nature of public keys meant to be that they're public?

dmux 7 hours ago  [ - ]

I think what the other comment is getting at is that you're essentially leaving footprints behind on various servers and that information could be used to narrow down who you are, where you work, etc. For example, if you used the same key pair for a work machine at the big social media site example.com as you did late.sh, they could probe example.com's machine and see that you'd been there.

plaidwombat 10 hours ago  [ - ]

All your base are belong to us. We recommend rotating keys more often than never.

ErroneousBosh 12 hours ago  [ - ]

l33t h4xx0r5

nntlol 12 hours ago  [ - ]

[dead]