*sshole · sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
Bluesky SSH Authentication #2
Addressing the glaring omissions from yesterday’s proof of concept, such as the fact that you could sign in as any user, you couldn’t revoke access, all hosts had the same users, and there was no mapping between Bluesky handles and POSIX users, I have updated mtelvers/bluesky-ssh-key-extractor and newly published mtelvers/bluesky-collection.
長いパスワードで認証を回避する脆弱性「*sshole」、「Alpine Linux」などに影響／2016年から存在、「OpenSSH 10.6p2」で対策
「OpenSSH」に関連する脆弱性「*sshole」が報告され、影響する製品で対策が急がれている。
Cache8063/atauth
AT Protocol (Bluesky) authentication library for Rust, TypeScript, and Node.js
AChep/keyguard-app
A password manager that supports Bitwarden platform and KeePass (KDBX) files. It autofills your logins, supports passkeys, works offline, and runs a Watchtower that finds leaked and reused passwords and other issues.
HOW TO: Self-hosting and securing web services out of your home with Argo Tunnel, nginx reverse proxy, Let's Encrypt, Fail2ban (H/T Linuxserver SWAG)
215 votes, 102 comments. Changelog V1.3a - 1 July 2023 DEPRECATED - Legacy tunnels as detailed in this how-to are technically no longer supported…
better-auth-bsky - npmx
A better-auth plugin that adds ATProto/Bluesky OAuth 2.1 authentication (DPoP, PAR, PKCE) via @atcute/oauth-node-client.
Shibboleth Authentication Request
Shibboleth Authentication Request
Shibboleth Authentication Request
Shibboleth Authentication Request
Shibboleth Authentication Request
I've been saying for nearly a year that getting the UX right for bsky's OAuth deployment is a major inflection point for reinforcing users mental models If we phrase things right, people will learn that this password UX controls access to my identity + slices of my atmosphere data (via my PDS)
Paul Rohr
Claude is inheriting a centralized app-centric bias here (which existing OAuth profiles may share) To wind up in a decentralized world where all "my data" lives on "my PDS" -- regardless of how many atproto apps I authorize to store stuff there for me (see 🧵) -- we should invert that paradigm