The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

    Mastodon

  • Twitter Updates

  • My Flickr Stream

    20140508-Delphi-2007--Project-Options--Cannot-Edit-Application-Title-HelpFile-Icon-Theming20140430-Fiddler-Filter-Actions-Button-Run-Filterset-now20140424-VMware-Fusion-6.0.3.-no-reclaimable
    More Photos

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,860 other subscribers
«
»

Tribal Knowledge? Getting the public keys from github and gitlab users from their username

Posted by jpluimers on 2025/04/03

Learned a while ago: if you have the username from a GitHub or GitLab user, you can download interesting that sometimes can make life easier (but not necessarily more secure):

  • github.com/username.keys gives you their public SSH keys
  • gitlab.com/username.keys gives you their public SSH keys
  • github.com/username.png gives you their profile image

And that there are tools like gh, glab and age that can make direct use of them.

I love Twitter, so thanks for these for teaching me these little tricks:

It also made me discover gh and glab (which was inspired by gh): command-line interface tools to make GitHub and GitLab life easier.

Most relevant links of these tools below.

But first the tweets:

There was an interesting discussion on security. Of course using a SSH private key for one purpose is more safe than sharing SSH keys, just like it is when re-using passwords. On the other hand SSH-key users often are more aware of security issues than password-only users.

Both SSH and password based authentication can (and I think should) be combined with MFA methods (like SMS/TOTP/U2F/FIDO) making it more secure. The specific MFA mechanism is then the choice of each target platform.

gh

glab

age

  • [Wayback/Archive] FiloSottile/age: A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.

    age is a simple, modern and secure file encryption tool, format, and Go library.

    It features small explicit keys, no config options, and UNIX-style composability.

    …

    RECIPIENT can be an age public key generated by age-keygen ("age1...")
or an SSH public key ("ssh-ed25519 AAAA...", "ssh-rsa AAAA...").
  • [Wayback/Archive] age(1) – simple, modern, and secure file encryption (note that the Wayback Machine cannot correctly archive this: it archives the script but not the content)
  • [Wayback/Archive] FiloSottile/age: Encrypting to a GitHub user

    SSH keys

    As a convenience feature, age also supports encrypting to ssh-rsa and ssh-ed25519 SSH public keys, and decrypting with the respective private key file. (ssh-agent is not supported.)

    $ age -R ~/.ssh/id_ed25519.pub example.jpg > example.jpg.age
$ age -d -i ~/.ssh/id_ed25519 example.jpg.age > example.jpg

    Note that SSH key support employs more complex cryptography, and embeds a public key tag in the encrypted file, making it possible to track files that are encrypted to a specific public key.

    Encrypting to a GitHub user

    Combining SSH key support and -R, you can easily encrypt a file to the SSH keys listed on a GitHub profile.

    $ curl https://github.com/benjojo.keys | age -R - example.jpg > example.jpg.age

    Keep in mind that people might not protect SSH keys long-term, since they are revokable when used only for authentication, and that SSH keys held on YubiKeys can’t be used to decrypt files.

ssh-import-id

--jeroen

This entry was posted on 2025/04/03 at 12:00 and is filed under *nix, *nix-tools, ArchiveTeamWarrior, Conference Topics, Conferences, Development, Event, GitHub, GitLab, Internet, InternetArchive, OpenSSH, Power User, Software Development, Source Code Management, SSH, ssh/sshd, WayBack machine. Tagged: , . You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

«
»