Comment on *sshole is a banger of a name

Grostleton@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago

• doughless@lemmy.world ⁨1⁩ ⁨day⁩ ago

  ssh allows you to add trusted public key. When you ssh from a computer that has the private key, it will immediately log you in without asking for your password.

  source

  • Grostleton@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago

    Ok, but what’s a certicate?

    source

    • surewhynotlem@lemmy.world ⁨1⁩ ⁨day⁩ ago

      Oh, a certicate is a typo that most people miss

      source
    • Fontasia@feddit.nl ⁨1⁩ ⁨day⁩ ago

      Overly basically, it’s a file based way to prove you can log into an account

      There is information in file that the computer can verify that you created the certificate on this computer while already having access to this account, therefore you are allowed access.

      In most contexts, digital certificates are considered more secure than a password for authentication, so in creating one, it’s a pretty typical thing to disable being able to log in with a password. However, this bug allows account access with a garbage password.

      source

      • Grostleton@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago

        OK, but what’s a certicate?

        source

        • -> View More Comments
    • mumblerfish@lemmy.world ⁨1⁩ ⁨day⁩ ago

      I think they meant certificate, and are perhaps referencing the eMudhra incident?

      source

      • Carl@anarchist.nexus ⁨1⁩ ⁨day⁩ ago

        No, there was an SSH vulnerability discovered a day or two ago, which allows anyone to log in with a fake certificate. So if your SSH is configured to only use a certificate, (not cert and password) then anyone can log into your shit.

        source

        • -> View More Comments