A ssh server that knows who you are. $ ssh whoami.filippo.io

43 pointsposted 2 days ago
by modinfo
(github.com)

6 Comments

pseudohadamard

2 days ago

It's an artefact of OpenSSH braindamage, like a WiFi device spraying probe requests OpenSSH sprays all of your keys to any server it connects to and then takes whatever the server responds with as the one to auth. There's a CVE for this, CVE-2016-20012, but the OpenSSH maintainers rejected it as by-design, https://github.com/openssh/openssh-portable/pull/270.

FiloSottile

a day ago

If that PR were merged, whoami.filippo.io would still work the same. It would just receive signed requests instead of queries.

seg_lol

2 days ago

It has downloaded every public key from github?

I would use this trick to add them to my test clusters.

fragmede

a day ago

Yes, but telling people to run

    ssh -o IdentityAgent=/dev/null -v  -o IdentityFile=/dev/null funky.nondeterministic.computer
instead of just

     ssh funky.nondeterministic.computer
is harder to sell.

locke3891

a day ago

For those that care about privacy, couldn't you just use an alias? alias ssh='ssh -o IdentityAgent=/dev/null -o IdentityFile=/dev/null -v' then you can do ssh funky.nondeterministic.computer and get the same functionality.