Hacker News Reader

When using publickey auth method, you don't have to provide anything (except for, obviously, username and hostname), you have to temporarily trust thimbl.net's key. I.e:, the process is:

1. thimbl.net provides its public key.

2. You add it to ~/.ssh/authorized_keys (or whatever your SSH server uses).

3. ...

4. That's it (remove key if you don't trust thimbl anymore or thimbl may even remove it by itself, at the end of setup process).

View on HN

That would give us access to the users account at any time. It seems requiring their password be sent with every request is more secure (over https, of course)

The thing that you are failing to realize is that it's easier to lock down access using a public key than a password. You can specify the amount of access an incoming ssh connection has based on the public key. You can't do that w/ a password.

I could have multiple keys, all w/ different access levels, all on the same user account. There is no way to do this with a password, other than to just have separate user accounts.

I'm pretty clear on how ssh works. We can certainly add support keys as well, once we get the initial release out ;)

Reply on news.ycombinator.com