Hacker News Reader

Comment by Godel_unicode | Hacker News Reader

If you're concerned about hostname leakage in your pubkeys, you're almost certainly doing something wrong.

If you want SSH access to Github or Gitlab, you'll need to paste your pubkey there. Leaking your user@host can be a concern if you're trying to maintain anonymity, e.g. Gwern, particularly if your username is your real name. You can strip out the user@host part from the paste, but it's safer to just get rid of it. It's easy to accidentally paste the whole thing into an .ssh/authorized_keys file, for example.

Admittedly this isn't an issue for most people.

If you're trying to maintain anonymity, why is your username your real name?

Even if it's not, your default hostname when using a MacBook Pro is typically "<username>s-MacBook-Pro.local" which reveals you're using a MacBook Pro. That info leak probably doesn't matter, but generally you want to reveal as little information as possible.

As one example, a hostname leak might hypothetically be useful for a spearfishing+XSS attack.

What kind of person cares enough about anonymity to change the comment in their ssh key, but not change the default hostname of their Mac? That person is very inconsistent.

Why does ssh-keygen include unnecessary information by default?

Because it helps usability when the user is editing ~/.ssh/authorized_keys - if the default is not changed, the key comment has some context, so finding the right key is easier.

I strip comments from my SSH keys too for the same reason you do. But most people don't seem to care and there is a reason for the default.

Hardly unnecessary. Very useful to see which key is what when you have multiple.

Your right. I just checked mine and it was:

esau@europa.hsd1.fl.comcast.net

Not a big deal but it does reveal my ISP and state.

Comment section is set to what it is because this is easier way to tell where the public key comes from. It vastly simplifies key management, which is much more important than the tiny bits of anonymity you get from not setting the comment.

Anonymity is a different issue from security. You might get a little extra of that by taking user info from keys, but IMO for anonymity you should ensure your user info does not link to the real person.

GitHub does not display the comment of the SSH key to the public, check yourself:

https://github.com/<username>.keys

You're writing as if a person can only ever have one pubkey, you can create a new pair just for github.

It's worth noting both GitHub and GitLab strip the comment off the keys.

https://github.com/Lattyware.keys - GitHub leave it blank:

  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGAx5F7iJTDwbPrdhrTtVdQRtozcRDvGNuU7BB+4+mHi
  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6WfINFFvzT+Z+l5sYq9zJoyXPLL27v9vvE1+p1XOiW

https://gitlab.com/latty.keys - GitLab add a generated comment:

  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6WfINFFvzT+Z+l5sYq9zJoyXPLL27v9vvE1+p1XOiW Gareth Latty (gitlab.com)
  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGAx5F7iJTDwbPrdhrTtVdQRtozcRDvGNuU7BB+4+mHi Gareth Latty (gitlab.com)

In my case, I'd actually quite like the comments to be left in, one of those is my personal key, one is for work. Differentiating is useful depending on why I have access.

Certainly, but your user@host will be leaked to the staff of Github / Gitlab and to anyone that compromises your account. The unfortunate thing about anonymity is that a small mistake can be costly. It depends what your threat model is, though.

How so? Why should I give out my username and host with the key? In many applications I see no need for them.

No, this is a completely unnecessary piece of information that ssh is unnecessarily jamming into the pubkey. What possible use does including the hostname of the generating machine serve for public key authentication?

Today it's my hostname. Tomorrow ssh-keygen (with default arguments) could start including more sensitive information, like the IPv6 address of my machine that's open to the internet and its exact OS version, and leave me open to a lot of attacks. Hence, I'm not going to trust the default arguments for it.

First, this field is important. It's not used for authentication in any way, as it's just an optional comment, ignored by sshd otherwise. It's not an information for sshd, though: it's information for human user. Without this comment you don't have an easy way to tell where the keys come from.

Second, if you don't trust ssh-keygen, why the heck do you use it in the first place?

I didn't say I don't trust it, just that I don't trust that it won't leak private info when using the default arguments.

Why it would suddenly leak such information? User+host is put in the comment field for dozen years already, if not longer (and has quite good explaination why it is there). Where does this distrust of yours come from? It's completely opaque to me.

Reply on news.ycombinator.com