$ ssh stickr.shop
@stickr.shop
56 followers 108 following 40 posts
We sell you your nerdy laptop stickers that you desperately desire, the way they are supposed to be sold… In your terminal! $ ssh stickr.shop
We sell you your nerdy laptop stickers that you desperately desire, the way they are supposed to be sold… In your terminal! $ ssh stickr.shop
![Screenshot of an issue opened on Github:
[FEATURE] [security] Adding DNSSEC and SSHFP records #2
Open
altf4arnold opened yesterday · edited by altf4arnold
What feature do you want?
I would like you to implement DNSSEC with SSHFP records.
What problem does this solve?
With HTTPS, you can be certain that the website isn't being spoofed. Apart of encrypting your connection, it also validates the authenticity of the cert against a root CA.
In this current state, the SSH server will answer with a key. But there is no real way to verify said key's authenticity against anything. So basically, anyone could spoof the server and take away money from potential customers.
It is like leaving a HTTPS website open with a self-signed certificate
How should it work?
Providing the user does know how to use it (sadly requires a manual activation in your ssh-client configuration and the use of a resolver that doesn't predate the year 2000), your ssh client will compare the key provided by the server with the one provided by DNS.
Example on my own git server :
The authenticity of host 'git.adechamps.net (2a01:4f9:c012:4921::1)' can't be established.
ED25519 key fingerprint is: SHA256:7cRwIz8b9WeyFKp/IIJarR14o3K5P/vLP8hwjiWudUk
Matching host key fingerprint found in DNS.
You can see that it first doesn't know if my server is authentic, it will then look it up in the DNS and see that it found a match. So this is probably authentic (and if it finds a key and it doesn't match, it will prevent you from connecting all at once)](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:gmmu6ookqloys74yqblqfaw5/bafkreidq2y2pgnlj6qrkzj5grsuyx7apw6ucpg2a7hjs2x6y6cy5qgugya)
