We updated our RSA SSH host key (github.blog)

Article summary

GitHub updated its RSA SSH host key due to a brief exposure of the private key in a public repository. The change affects Git operations over SSH using RSA, but not web traffic or HTTPS Git operations. The new key is documented on GitHub's website. Users may see a warning about the changed host identification and need to update their known hosts file.

Main themes

• SSH key rotation
• security risks
• man-in-the-middle attacks
• automation pipelines
• certificate management
• logging and monitoring
• cost-benefit analysis
• security best practices

What commenters say

• Rotating the key is necessary to prevent potential man-in-the-middle attacks, despite the risk of breaking automation pipelines.
• The decision to rotate the key should be based on a cost-benefit analysis of the security risks involved.
• GitHub should have considered the potential impact on users and provided better communication and mitigation strategies.
• The use of certificates could make key rotation easier and more secure.
• The exposure of the private key highlights the importance of logging and monitoring to detect and respond to security incidents.
• The risk of a man-in-the-middle attack is a perpetual risk if the key is not rotated, whereas the risk of breaking automation pipelines is a one-time risk.
• Assuming the worst-case scenario and rotating the key is the most prudent course of action when a private key is exposed.
• The security benefits of rotating the key outweigh the potential inconvenience to users.