The Backend Engineering Show with Hussein Nasser
The Backend Engineering Show with Hussein Nasser
Hussein Nasser
GitHub SSH key is Leaked - How bad is this?
21 minutes Posted Mar 30, 2023 at 11:22 am.
Intro
What happened?
SSH vs TLS Authentication
SSH Connect
How bad is the github leak?
What should you do?
Is ECDSA immune?
0:00
21:56
Download MP3
Show notes
GitHub Accidentally Exposed their SSH RSA Private key, this is the message you will get .
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s.
Please contact your system administrator.
Add correct host key in ~/.ssh/known_hosts to get rid of this message.
Host key for github.com has changed and you have requested strict checking.
Host key verification failed.
In this video I discuss how bad is this,.
https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/