points by tptacek 1 day ago | 0 comments
You don't have to distribute fingerprints by hand. SSH already has a built-in PKI that handles this, and it's what most large fleet operators use (it's also the simplest way to connect an SSH fleet to an SSO IdP). SSH certificates, not WebPKI certificates.
[–] eqvinox 1 day ago
[–] tptacek 1 day ago
I read your whole post, which ended with "if users copy around fingerprints", which is a problem the built-in SSH PKI that large fleet operators already use solves. I don't think I misconstrued you.
You don't have to keep replying, but I'm going to point out that we have gotten no closer to finding a reason that anyone would even entertain the idea of SSHFP, a system that wires the already perfectly good SSH PKI subsystem into the state-controlled DNS PKI. Why would anybody ever do that?
[–] sscaryterry 19 hours ago
The op is known to not read and spew propaganda.
I know. I'm discussing them in my post.
If you're replying on posts without reading them in their entirety, that certainly explains some of the communication issues we were having on another post (re. DANE) a while back. I don't think I'm interested in any further exchange with you.