Bugtraq mailing list archives
Re: SSH host key fingerprint - through HTTPS
From: Chris Nehren <cnehren+bugtraq () pobox com>
Date: Mon, 1 Sep 2014 11:16:27 -0400
On Mon, Sep 01, 2014 at 12:41:17 +0800, John Leo wrote:
This tool displays SSH host key fingerprint - through HTTPS. SSH is about security; host key matters a lot here; and you can know for sure by using this tool. It means you know precisely how to answer this question: The authenticity of host 'blah.blah.blah (10.10.10.10)' can't be established. RSA key fingerprint is a4:d9:a4:d9:a4:d9a4:d9:a4:d9a4:d9a4:d9a4:d9a4:d9a4:d9. Are you sure you want to continue connecting (yes/no)? https://checkssh.com/
Err, let me be sure I understand this tool properly. You have a web service--for which you do not provide the source code--that provides the same information that an ssh client provides. Not providing the source code means that everything from malicious manipulation to bugs are possible and the general public has no means of verification that such do not exist. Beyond that, as said, it provides the same information that the ssh client does, out of band, meaning that it's less convenient and thus less likely to be used. How, then, is this useful? Sure, I can see the value in having another point of presence to validate the ssh key of a server--but ideally, if one cares about the key of a server (which key, by the way? The RSA key? Or maybe the ECDSA? Why not DSA?), one should contact the system administrator over a secure channel *before* connecting and establish the keys over that channel. Lacking source code and control over the server, this service is just as vulnerable to all the attacks that I assume your tool is attempting to mitigate. It's Monday and I haven't had my tea yet, so maybe I'm missing something. What is it? -- Chris Nehren
Attachment:
_bin
Description:
Current thread:
- SSH host key fingerprint - through HTTPS John Leo (Sep 01)
- Re: SSH host key fingerprint - through HTTPS Micha Borrmann (Sep 01)
- Re: SSH host key fingerprint - through HTTPS John Leo (Sep 02)
- Re: SSH host key fingerprint - through HTTPS Chris Nehren (Sep 01)
- Re: SSH host key fingerprint - through HTTPS Lukasz Biegaj (Sep 02)
- Re: SSH host key fingerprint - through HTTPS Jamie Riden (Sep 02)
- Re: SSH host key fingerprint - through HTTPS Lukasz Biegaj (Sep 02)
- Re: [FD] SSH host key fingerprint - through HTTPS maxigas (Sep 02)
- Re: [FD] SSH host key fingerprint - through HTTPS John Leo (Sep 02)
- Message not available
- Re: [FD] SSH host key fingerprint - through HTTPS Jeroen van der Ham (Sep 02)
- Re: [FD] SSH host key fingerprint - through HTTPS John Leo (Sep 02)
- Re: [FD] SSH host key fingerprint - through HTTPS Jeroen van der Ham (Sep 02)
- Re: SSH host key fingerprint - through HTTPS Micha Borrmann (Sep 01)
- Message not available
- Re: [FD] SSH host key fingerprint - through HTTPS john (Sep 02)
- Message not available
- Re: [FD] SSH host key fingerprint - through HTTPS John Leo (Sep 02)