Hacker News Reader

I flicked through the article and couldn't see it written quickly - what information could be extracted from my SSH public key and how?

View on HN

It seems like they won't say unless you are willing to pay

> Enigma Bridge has expanded on the discovery and built a tool that can with great accuracy tell which security mechanisms companies use for their https key generation.

which software (e.g. ssh-keygen, puttygen) you used to generate it.

I don't see why this is a big deal. There are only a handful of such programs (as shown by this goofy graph with no y axis label[1]). If one or more of them is vulnerable, an attacker can just try all (< 20?) possible exploits without bothering to sniff for information leaks. Otherwise, sniffing those leaks tells him you run foobar-keygen, which leaks its identity and has no known vulnerabilities.

[1] http://i0.wp.com/dan.enigmabridge.com/wp-content/uploads/201...

Reply on news.ycombinator.com