OpenSSH is about to change. (For the better.) (www.youtube.com)
from ademir@lemmy.eco.br to linux@lemmy.ml on 04 Dec 2023 00:22
https://lemmy.eco.br/post/2042378

OpenSSH’s ssh-keygen command just got a great upgrade.

New video from @vkc@mspsocial.net

Edit:

She has a peertube channel: !veronicaexplains@tinkerbetter.tube and it federatess as a Lemmy Community

The Peertube video in Lemmy.ml: lemmy.ml/post/8842820

Link to the video in your instance.

#linux

threaded - newest

PipedLinkBot@feddit.rocks on 04 Dec 2023 00:23 next collapse

Here is an alternative Piped link(s):

https://piped.video/tdfBbpJPTGc

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I’m open-source; check me out at GitHub.

SteveTech@programming.dev on 04 Dec 2023 01:13 next collapse

Woah peertube federating with lemmy is actually really cool!

ademir@lemmy.eco.br on 04 Dec 2023 15:36 collapse

right!? the fediverse is so cool!

kool_newt@lemm.ee on 04 Dec 2023 03:59 next collapse

In 2005, Curve25519 was first released by Daniel J. Bernstein.[5] (en.wikipedia.org/wiki/Curve25519)

DJB? Nice! Always been a fan.

rammer@sopuli.xyz on 04 Dec 2023 05:41 next collapse

Yeah, look at the curves on that guy.

NoSpotOfGround@lemmy.world on 04 Dec 2023 06:39 collapse

It says that

Starting in 2014, OpenSSH defaults to Curve25519-based ECDH.

So what changed recently? (I didn’t watch the video, in fairness).

domi@lemmy.secnd.me on 04 Dec 2023 08:05 collapse

ssh-keygen now defaults to ed25519 so you don’t have to do ssh-keygen -t ed25519 anymore. The default since 2014 is for key exchange when connecting.

NoSpotOfGround@lemmy.world on 06 Dec 2023 06:31 collapse

Got it, thank you!

RegalPotoo@lemmy.world on 04 Dec 2023 04:55 next collapse

tl;dw - ed25519 keys are now the default

ultra@feddit.ro on 04 Dec 2023 06:20 next collapse

Nice!

Grass@sh.itjust.works on 04 Dec 2023 07:00 next collapse

From the thumbnail I was wondering if it was this. Thanks for saving me the watch.

Synthead@lemmy.world on 04 Dec 2023 07:44 next collapse

Thanks for reducing the click bait.

WalrusByte@lemmy.world on 04 Dec 2023 17:23 next collapse

Oh nice! That’s the key type I use anyway, so nice to know I don’t have to pass as many options in now

MigratingtoLemmy@lemmy.world on 04 Dec 2023 20:27 collapse

Finally damnit

lntl@lemmy.ml on 04 Dec 2023 06:13 next collapse

i don’t think I’ve created an RSA key since 2017

aard@kyu.de on 04 Dec 2023 06:20 next collapse

A surprising amount of services (including Azure last I tried) can only handle RSA keys, so after trying ecdsa only for a while I ended up adding a RSA key again.

With that said - it’s 2023, in almost all cases you should have your keys in a hardware module nowadays, in which case you’d use a different command for keygeneration.

Helix@feddit.de on 04 Dec 2023 08:37 next collapse

ed25519 ≠ ecdsa

fossisfun@lemmy.ml on 04 Dec 2023 11:31 collapse

Actually it is the same story with TLS 1.3 and TLS 1.2. A bunch of sites still doesn’t support TLS 1.3 (e. g. arstechnica.com, startpage.com) and some of them only support TLS 1.2 with RSA (e. g. startpage.com).

You can try this yourself in Firefox by disabling ciphers (search for security.ssl3 in about:config) or by setting the minimum TLS version to 1.3 (security.tls.version.min = 4 in about:config).

deepdive@lemmy.world on 04 Dec 2023 15:40 collapse

Strange enough TLS 1.3 still doesn’t support signed ed25519 certificates :| P‐256, NIST P‐384 or NIST P‐521 curves are known to be “backdoored” or having deliberately chosen mathematical weakness. I’m not an expert and just a noob security/selfhoster enthusiast but I don’t want to depend on curves made by NSA or other spy agencies !

I also wondering if the EU isn’t going to implement something similar with all their new spying laws currently discussed…

LaggyKar@programming.dev on 05 Dec 2023 08:24 collapse

AFAIK, they’re not known to be backdoored, only suspected

deepdive@lemmy.world on 05 Dec 2023 16:48 collapse

Yeah wrong wording, but the fact that we have to depend mostly on NSA’s cryptographic schemes makes it very suspicious !

018118055@sopuli.xyz on 04 Dec 2023 07:47 next collapse

I had to create one this year after discovering that connectbot (ssh client on Android) didn’t support agent forwarding otherwise.

lemann@lemmy.one on 04 Dec 2023 09:43 next collapse

Probably a good idea to look for a different client, call me tinfoil but I wouldn’t want to touch a very old mechanism that is supported/pushed by a very recognisable 3 letter agency

LiveLM@lemmy.zip on 04 Dec 2023 10:23 next collapse

I’ve just started using SSH inside of Termux, got tired of all the weird pitfalls SSH Clients for Android usually have

018118055@sopuli.xyz on 04 Dec 2023 14:10 collapse

Probably. It’s in f-droid but increasingly looking not quite unmaintained, but not developed actively enough.

lntl@lemmy.ml on 04 Dec 2023 19:19 collapse

considered harmful

lemann@lemmy.one on 04 Dec 2023 09:48 collapse

I delete them from the ssh config folder after installation, along with the DSA and ECDSA keys. No ed25519? No auth.

Also prevents a handful of bots from attempting SSH login into your cloud infra, a lot of them don’t support ed25519 kex

const_void@lemmy.ml on 04 Dec 2023 14:52 next collapse

YouTube thumbnails are cancer

Blackmist@feddit.uk on 04 Dec 2023 15:02 next collapse

…mozilla.org/…/clickbait-remover-for-youtube/

ky56@aussie.zone on 04 Dec 2023 15:19 collapse

DeArrow by the same developer as SponsorBlock seems to be actively developed and community contributions are fast.

duncesplayed@lemmy.one on 05 Dec 2023 00:33 collapse

YouTube titles, too :(

CarbonScored@hexbear.net on 04 Dec 2023 14:58 next collapse

TL;DR: It’ll use a new, more secure key type.

Pantherina@feddit.de on 04 Dec 2023 15:46 collapse

Nice no ChatGPT anymore to remember how that damn Algorithm is spelled.

Why not just call it RSB ? People, really!