On Mon, Sep 01, 2014 at 12:41:17 +0800, John Leo wrote: > This tool displays SSH host key fingerprint - through HTTPS. > > SSH is about security; host key matters a lot here; and you can know > for sure by using this tool. It means you know precisely how to answer > this question: > The authenticity of host 'blah.blah.blah (10.10.10.10)' can't be established. > RSA key fingerprint is a4:d9:a4:d9:a4:d9a4:d9:a4:d9a4:d9a4:d9a4:d9a4:d9a4:d9. > Are you sure you want to continue connecting (yes/no)? > > https://checkssh.com/ Err, let me be sure I understand this tool properly. You have a web service--for which you do not provide the source code--that provides the same information that an ssh client provides. Not providing the source code means that everything from malicious manipulation to bugs are possible and the general public has no means of verification that such do not exist. Beyond that, as said, it provides the same information that the ssh client does, out of band, meaning that it's less convenient and thus less likely to be used. How, then, is this useful? Sure, I can see the value in having another point of presence to validate the ssh key of a server--but ideally, if one cares about the key of a server (which key, by the way? The RSA key? Or maybe the ECDSA? Why not DSA?), one should contact the system administrator over a secure channel *before* connecting and establish the keys over that channel. Lacking source code and control over the server, this service is just as vulnerable to all the attacks that I assume your tool is attempting to mitigate. It's Monday and I haven't had my tea yet, so maybe I'm missing something. What is it? -- Chris Nehren
Attachment:
pgpi2mSWe12Kw.pgp
Description: PGP signature