Hacker News .hnnew | past | comments | ask | show | jobs | submit | computersnail's commentslogin

Your private key is not sent to the ssh server. They could do something else nasty like collect keystrokes from your session on the fake server though.


More specifically:

Out of the box your SSH client will only use its private key to prove that it knows the key (it signs a message specific to the SSH connection) during login.

I think this is properly designed so that a bad guy can't live proxy it - if the bad guy gives a victim parameters the bad guy can decrypt those don't match on a real server; if they use the real parameters they're no longer able to read the session so why bother.

For environments where you want proxy behaviour (e.g. "jumpboxes") you can tell the client to volunteer to sign on behalf of further clients down the chain. Bad guys could use that but they still don't get the actual key so they must conduct any attack live, and clients could tell you about or even ask you to explicitly authorise every such request.


I think he is talking about the session key via a MITM.


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: