Comment by h43z

6 days ago

Reminder to be cautious about leaking public keys.

Once you leak your public key it could be used to check if another server recognizes that leaked public key.

18 comments

h43z

Reply
alentred  6 days ago

Did I miss something? Aren't public key are supposed to be public?

To be clear, that's an honest question, not sarcasm of anything. I only assume I don't know about some corner case with SSH or something? Because we have those on our websites, they are supposed to be used to verify signatures, etc. How is publishing them bad?

  • h43z  6 days ago

    It's just something everyone should be aware of.

    It's up to you to decide if it's okay that you send a server provider (in this case late.sh) a bunch of your public keys which he could for example use to probe other servers to see if you have access to them.

    Everyone has different opsec.

    • drabbiticus  6 days ago

      The site does include a way to use a throwaway key and IIRC it was there last night too.

          ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh

      Based on what another user said, you might want to modify the above command to use throwawayUsername@late.sh instead if you are going the throwaway route to be more certain you aren't leaking your OS username.

benj111  6 days ago

Surely you shouldn't be leaking your username. I could use it to see if another server recognised 'h43z'....

  • h43z  6 days ago

    OpenSSH server is designed not to reveal whether a username exists.

Zambyte  6 days ago

What?

  • h43z  6 days ago

    By default SSH leaks all of the below public keys (if they exist) + all public keys in your ssh-agent to a server you connect to.

      ~/.ssh/id_ecdsa.pub
  ~/.ssh/id_ecdsa_sk.pub
  ~/.ssh/id_ed25519.pub
  ~/.ssh/id_ed25519_sk.pub
  ~/.ssh/id_xmss.pub
  ~/.ssh/id_dsa.pub

    running `ssh late.sh` would do exactly that.

    At the very bottom of the website they give you a command that would not leak your public keys.

    `ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh`

    this would only send the late_throwaway public key

    • Zambyte  6 days ago

      Okay, but why is that something to be concerned about? How would one be able to probe to see if a server recognizes a public key? Why does that matter?

      10 replies →