Hacker News new | ask | show | jobs
by wulczer 4814 days ago
Better idea: check which of those keys are in the Debian Weak SSH Keys list and own their GitHub accounts (or find if they have any servers and start SSHing into them).

Less nefariously: send them an email asking to regenerate the key.
2 comments
bonzoesc 4814 days ago
GitHub already did that:

> Thanks to our new servers, known bad keys from Debian and Ubuntu are now blacklisted. We estimate that about 1000 keys in our database were impacted by this. If you get authentication errors using keys that worked a day ago, please double-check that they are not on our blacklist. If they are, you should ensure your software is updated and generate new keys. We’ve got a guide to help you out with this.

https://github.com/blog/500-state-of-the-hub-rackspace-day-0

link
ctz 4814 days ago
Or, for the RSA keys your find, calculate the GCD of each key with all others and see if any badly generated private keys fall out.
link