Hacker News Reader

Comment by pdq | Hacker News Reader

Found me; very nice. I wouldn't have guessed how you did it without the explanation about GitHub.

I wonder if this means we should be rotating keys periodically? I know most companies require users to rotate their password every X days.

Also, does GitHub have a setting to disable public key publishing?

View on HN

They're public keys, they're intended to be public. What are you trying to hide by hiding your public key?

Though it may be incredibly impractical or theoretically impossible, depending on the key and time of day, there is always a possibility that a public key can be used as an attack vector to guess a private key.

Or simply to DOS you out of your other accounts. https://news.ycombinator.com/item?id=10005358

As much as the keys contain public data, I wouldn't consider (but it apparently is) the list of keys with access to my github account public data. Github willingly reveals information about pseudonyms, etc.

This is a data vs metadata thing, the data is public, but who it belongs to, and what one can do with it need not be.

You should be using different key pairs on each client machine you log into. You should also be using different key pairs for each host to which you connect (and using ~/.ssh/config to specify which keys are sent to which hosts.)

Not only will this limit correlation as demonstrated here, but also make it much easier to revoke access via keys that may have been compromised.

Reply on news.ycombinator.com