Can you use this to id people for authentication? As in if someone pings your se... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

graderjs on Jan 9, 2023 | parent | context | favorite | on: ssh whoami.filippo.io

Can you use this to id people for authentication?

As in if someone pings your server and you get a key that matches their GitHub is it really that person's key or could they be doing it without having the corresponding private key?

vkoskiv on Jan 9, 2023 [–]

Anyone can download the public key and impersonate that person in a scheme like this.

notpushkin on Jan 9, 2023 | [–]

Unless you require them to authenticate using that key (which would obviously require them to have the private key on hand).

arjvik on Jan 9, 2023 | | [–]

What you are describing is the current status quo

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact