Hacker News Reader

Comment by upofadown | Hacker News Reader

SSH could really use a better default key fingerprint. It's 42 characters of base64. So a hodgepodge of upper and lower case Latin characters with some numbers and special characters mixed in. Not even any spaces to give it some structure. Basically just the output of of a 256 bit hash dumped directly to the terminal.

Perhaps more people would check it if the usability was improved...

View on HN

> SSH could really use a better default key fingerprint. It's 42 characters of base64.

You can get an ASCII graphic for the host key with the VisualHostKey option. For example:

  ssh -o VisualHostKey=yes tty.sdf.org

Alternatively, you can set this option permanently in the SSH client configuration like this:

  echo VisualHostKey yes >> ~/.ssh/config
  ssh tty.sdf.org

Here is an example output:

  $ ssh -o VisualHostKey=yes tty.sdf.org  
  Host key fingerprint is SHA256:ZjwbO7AU8rHJExYrmZS2LqGZ7WfdoELfMrF54W92PYA
  +--[ED25519 256]--+
  |    ...          |
  |   .oo o         |
  |   .=.*          |
  |  . .* B         |
  | = o  O S.       |
  |+ + o.o*E=.      |
  | o o O.++  o     |
  |  o X = +.. o    |
  |   + + +..   .   |
  +----[SHA256]-----+
  user@tty.sdf.org's password:

This graphic looks like a pigeon to me. Similarly, the one for github.com looks like a cat to me. For each server I connect to via SSH I know what the ASCII art for the host key looks like. This familiarity aids in performing TOFU in a hassle-free manner.

Yes, highly recommended. Easy to get used to the visual pattern of your important servers and notice if anything is off.

I would be interested in how good "looks like a cat to me" would be. It's trivial to generate 100,000 SSH keys and automatically select the most visually similar one. But would you notice the mismatch.

Usability would be improved if there was a one-click way to verify it. Off the top of my head a QR code you could scan so it'd be enough "out of band" that the odds of a compromise affecting both paths would be unlikely. Ideally someone smarter than me would come up with a way that it wouldn't require TOFU at all.

A well-known URI that provides SSH keys would be nice.

How would you encrypt / authenticate the URI? Assuming TLS adding this dependency to configure SSH may not be that desirable in some cases.

The original SSH threat model allowed for MITM, so you’d have to also allow for that happen to the SSH key distribution URI.

Context is key, it’s an interesting trade-off

Or you know SSHFP records + DNSSEC to verify hostkeys.

Which is something OpenSSH already supports.

The modern way seems to be a short string of emojis, ala Telegram voice calls.

Turn on ascii art.

Reply on news.ycombinator.com