Hacker News Reader

Comment by mbrock | Hacker News Reader

Sweet. You can fetch keys from GitHub by username without authenticating, so that could be a convenient way to avoid having to paste keys.

View on HN

If you assume a GitHub account, you might as well offer GitHub logins.

Sure, but once the thing knows my ssh key, I don't have to bother with GitHub anymore. My ssh key is on all my computers, but I'm not always logged into GitHub.

I have lots of different ssh keys, and don't share them among different client devices. I do share them across different services, but it turns into N*M anyway because I haven't figured out a good way to upload a generated public key from a client device once and have that flow across to all the ssh-compatible services I use. It seems like there should be something for this, but what tool could e.g. speak to both EC2 and GitHub?

Sounds like a good idea for an open source project!

I know, right? Not that it would be easy. ssh-copy-id is kind of an idea of how it could work, but that suffers from bootstrapping issues and doesn't seem to be supported except in very specific PaaS situations. A useful tool would have to dig into the idiosyncrasies of each service's auth policies, at least until it became popular enough that services would try to meet it halfway.

to clarify- you're envisioning a tool that takes in a new public key you've generated, and adds it to your list of authorized keys on various servers/SaaS/etc?

e.g.:

    ~/.ssh/authorized_keys
    api.github.com/user/keys
    iam.amazonaws.com/?Action=CreateAccessKey

and so on?

(edited for formatting)

Yes that would be ideal. b^)

The thinking is that we never want to move a private key, but public keys can go anywhere.

You could do this in theory with gpg by signing keys with a master key after generating them but there's no way to do it automatically with ssh (that I'm aware of)

I'm confused. Would this mean I could just grab anybody's public key and log in - as them - to a service that supported this?

No, you would need to have their private key.

No, you could just grab anybody's public key to verify their login (when they use their private key).

SSH keys are asymmetric. Think of public keys as locks and private keys as ... well, keys. You hand out copies of the lock but you keep the key to yourself. Anyone can put a lock on a box and know you're the only one who can open it. You tell them what lock to use and then use your key to open it to show them you are who you claim to be.

I think you could use Keybase as reference too.

Reply on news.ycombinator.com