Commits on Mar 26, 2023

1. Add the old github keys as revoked …

   The patch to update the bundled ssh github host key did not
   change anything for users who already had connected to github
   one time before via ssh: if the attacker had access to the old
   key, they'd be vulnerable to MITM attacks as their known_hosts
   file would list the old github key. Only if they connected
   again to github without attacker access, or if they saw the
   announcement of the key rotation, they would update their key.
   
   There is sadly no other way to distribute revocations of old host
   keys to clients other than to bundle them with client software.

   

   est31 committed Mar 26, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for cd654c7
   • Browse repository at this point

   Copy the full SHA

   cd654c7 View commit details

   Browse the repository at this point in the history