logoalt Hacker News

h43z • yesterday at 12:30 PM • 1 reply • view on HN

It's just something everyone should be aware of.

It's up to you to decide if it's okay that you send a server provider (in this case late.sh) a bunch of your public keys which he could for example use to probe other servers to see if you have access to them.

Everyone has different opsec.

Replies

drabbiticus • yesterday at 1:33 PM

The site does include a way to use a throwaway key and IIRC it was there last night too.

    ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh
Based on what another user said, you might want to modify the above command to use [email protected] instead if you are going the throwaway route to be more certain you aren't leaking your OS username.