Hacker News Reader

Usability would be improved if there was a one-click way to verify it. Off the top of my head a QR code you could scan so it'd be enough "out of band" that the odds of a compromise affecting both paths would be unlikely. Ideally someone smarter than me would come up with a way that it wouldn't require TOFU at all.

View on HN

Or you know SSHFP records + DNSSEC to verify hostkeys.

Which is something OpenSSH already supports.

A well-known URI that provides SSH keys would be nice.

How would you encrypt / authenticate the URI? Assuming TLS adding this dependency to configure SSH may not be that desirable in some cases.

The original SSH threat model allowed for MITM, so you’d have to also allow for that happen to the SSH key distribution URI.

Context is key, it’s an interesting trade-off

Reply on news.ycombinator.com