3 ms·

Because you need to create a public key for the browser to use.

rwmj 11y ago
SSH gets this right -- create a host key when the server is installed, and have the client check the key and only warn/error when it changes. Sure, this isn't super-secure for first time visitors to their banking website or whatever, but those websites can continue to use the current system.
- nothrabannosir 11y ago
  SSH doesn't get this right. It's no better than a (auto-pinned) self-signed cert, in our world. I challenge everyone to find in their extended group of friends and colleagues, and their friends and colleagues, a single person who consistently checks the fingerprint* on every first SSH connection. Id personally have a hard time finding someone who even knows it matters. And if you don't? Mitm can get your password, or tunnel your key to another host, bar some crazy ~/.ssh/config which nobody has. WiFi's WPA2 actually does this better than SSH; the passphrase authenticates both parties to eachother, not just one way. I can't set up a hotspot with your home SSID and intercept your PSK---even on initial connection. SSH: nice in a cryptographic utopia, not better than self signed SSL certs when applied to human beings. SSH is just not suitable for humans. Apparently. * a significant part of it, not just the security-through-obscurity random 2 letters in the middle and the last four.
  - ryanlol 11y ago
    -o VisualHostKey=yes
    - nothrabannosir 11y ago
      A band-aid, I'm afraid. Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Many SSH clients don't even support it, at all. PuTTY and almost anything that uses SSH for tunneling. When they do: how many of your hosts do you know the image of? Again: nice idea, but utterly impotent in our universe. Compare to the efficiency of e.g. WPA2 keys: less theoretically beautiful, but much more efficient with humans.
      - ryanlol 11y ago
        >Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Probably not very many, but it's really only useful for people that ignore basic security features anyway. (Key auth) >When they do: how many of your hosts do you know the image of? None, I use key auth like any reasonable person would.
        nothrabannosir 11y ago
        Does key auth protect you from a MITM on the first connection? That is, key auth as reasonable people use it, as you said. And this: > but it's really only useful for people that ignore basic security features anyway. (Key auth) is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right". And these are people who use SSH to begin with. Not typically technologically illiterate, I would guess. If they can't even be arsed to use "basic security features", what good is this system, then? Again: there is a way to use SSH properly, yes. But rare is the person who does this. (But key auth is orthogonal to host fingerprinting anyway, this is kind of a red herring)
        ryanlol 11y ago
        >Does key auth protect you from a MITM on the first connection? Yes. Key auth will protect you from your SSH connection being listened to, and will make credential theft reliant on social engineering. However, someone could still pretend to be the server (potentially stealing your commands), but there really doesn't exist any way to solve that. >is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right". Nothing works for those people, at least generally with SSH users you can assume that they should know better. >Again: there is a way to use SSH properly, yes. But rare is the person who does this. I'd hardly consider SSH key auth users rare. >(But key auth is orthogonal to host fingerprinting anyway, this is kind of a red herring) But it almost completely fixes the main problem caused by MitM, someone gaining access to the server you're logging into.
  - cellularmitosis 11y ago
    Still, there's a difference between being less than 100% secure and being a totally useless feature. Being able to make the statement "Either you've been consistently MitM'ed by the same entity for the past three years, or the your little cloud-based debian box is actually secure" is a lot more useful than not tracking SSH fingerprints at all. I certainly wish my browser would track my self-signed certs in this way.
- forgottenpass 11y ago
  SSH gets this right No, it doesn't. When was the last time you verified a host key out of band? And if you're using SSH, you know well enough to know why you should do the damn legwork to verify the key. What do you expect for end users? Furthermore, if nobody is doing out of band verification on the first pass, how do you expect users to distinguish between an attack and legit host key change?
  - rwmj 11y ago
    As I said above: Sure, this isn't super-secure for first time visitors to their banking website. But it's fine for the common case where someone tries to MITM you when you move from your home to a coffee shop or vice versa and you're just browsing sites that would otherwise be using http.
  - ryanlol 11y ago
    But the worst case scenario with SSH MitM isn't someone being able to eavesdrop on your connection. But someone pretending to be the server, which is hardly as serious. (Unless you're using password auth, in which case you deserve to get owned)
    - icebraining 11y ago
      If someone impersonates your server, it can then pass the authentication request to the original, and gain full MITM without your knowledge. Yes, even if you use public key auth.
      - ryanlol 11y ago
        I will personally pay you the sum of 500 Bitcoins if you can demonstrate a realistic active MitM attack on OpenSSH that allows an active network level attacker to "pass the authentication request to the original" and gain full MitM. Conditions: Public key authentication must be used for authentication. If it's possible to perform the attack passively(e.g on pcaps), it doesn't qualify. This attack has to affect setups using both the latest OpenSSH client and server with default configuration. This attack has to be able to be performed in realtime using the processing power of a 2015 macbook model of your choosing. This attack cannot rely on attacker having any other access but the ability to tamper with the connection however much he wants. This attack cannot rely on known flaws in the encryption algorithms. With full MitM I am referring to the ability to at least access the plaintext communications between the client and server. Eg if the user runs 'sudo', the ability to see the password entered. Please consider this offer legally binding, if you have any questions I will answer them and you can consider the answers binding too. Good luck.

rwmj 11y ago

SSH gets this right -- create a host key when the server is installed, and have the client check the key and only warn/error when it changes. Sure, this isn't super-secure for first time visitors to their banking website or whatever, but those websites can continue to use the current system.

nothrabannosir 11y ago
SSH doesn't get this right. It's no better than a (auto-pinned) self-signed cert, in our world. I challenge everyone to find in their extended group of friends and colleagues, and their friends and colleagues, a single person who consistently checks the fingerprint* on every first SSH connection. Id personally have a hard time finding someone who even knows it matters. And if you don't? Mitm can get your password, or tunnel your key to another host, bar some crazy ~/.ssh/config which nobody has. WiFi's WPA2 actually does this better than SSH; the passphrase authenticates both parties to eachother, not just one way. I can't set up a hotspot with your home SSID and intercept your PSK---even on initial connection. SSH: nice in a cryptographic utopia, not better than self signed SSL certs when applied to human beings. SSH is just not suitable for humans. Apparently. * a significant part of it, not just the security-through-obscurity random 2 letters in the middle and the last four.
- ryanlol 11y ago
  -o VisualHostKey=yes
  - nothrabannosir 11y ago
    A band-aid, I'm afraid. Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Many SSH clients don't even support it, at all. PuTTY and almost anything that uses SSH for tunneling. When they do: how many of your hosts do you know the image of? Again: nice idea, but utterly impotent in our universe. Compare to the efficiency of e.g. WPA2 keys: less theoretically beautiful, but much more efficient with humans.
    - ryanlol 11y ago
      >Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Probably not very many, but it's really only useful for people that ignore basic security features anyway. (Key auth) >When they do: how many of your hosts do you know the image of? None, I use key auth like any reasonable person would.
      - nothrabannosir 11y ago
        Does key auth protect you from a MITM on the first connection? That is, key auth as reasonable people use it, as you said. And this: > but it's really only useful for people that ignore basic security features anyway. (Key auth) is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right". And these are people who use SSH to begin with. Not typically technologically illiterate, I would guess. If they can't even be arsed to use "basic security features", what good is this system, then? Again: there is a way to use SSH properly, yes. But rare is the person who does this. (But key auth is orthogonal to host fingerprinting anyway, this is kind of a red herring)
        ryanlol 11y ago
        >Does key auth protect you from a MITM on the first connection? Yes. Key auth will protect you from your SSH connection being listened to, and will make credential theft reliant on social engineering. However, someone could still pretend to be the server (potentially stealing your commands), but there really doesn't exist any way to solve that. >is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right". Nothing works for those people, at least generally with SSH users you can assume that they should know better. >Again: there is a way to use SSH properly, yes. But rare is the person who does this. I'd hardly consider SSH key auth users rare. >(But key auth is orthogonal to host fingerprinting anyway, this is kind of a red herring) But it almost completely fixes the main problem caused by MitM, someone gaining access to the server you're logging into.
- cellularmitosis 11y ago
  Still, there's a difference between being less than 100% secure and being a totally useless feature. Being able to make the statement "Either you've been consistently MitM'ed by the same entity for the past three years, or the your little cloud-based debian box is actually secure" is a lot more useful than not tracking SSH fingerprints at all. I certainly wish my browser would track my self-signed certs in this way.
forgottenpass 11y ago
SSH gets this right No, it doesn't. When was the last time you verified a host key out of band? And if you're using SSH, you know well enough to know why you should do the damn legwork to verify the key. What do you expect for end users? Furthermore, if nobody is doing out of band verification on the first pass, how do you expect users to distinguish between an attack and legit host key change?
- rwmj 11y ago
  As I said above: Sure, this isn't super-secure for first time visitors to their banking website. But it's fine for the common case where someone tries to MITM you when you move from your home to a coffee shop or vice versa and you're just browsing sites that would otherwise be using http.
- ryanlol 11y ago
  But the worst case scenario with SSH MitM isn't someone being able to eavesdrop on your connection. But someone pretending to be the server, which is hardly as serious. (Unless you're using password auth, in which case you deserve to get owned)
  - icebraining 11y ago
    If someone impersonates your server, it can then pass the authentication request to the original, and gain full MITM without your knowledge. Yes, even if you use public key auth.
    - ryanlol 11y ago
      I will personally pay you the sum of 500 Bitcoins if you can demonstrate a realistic active MitM attack on OpenSSH that allows an active network level attacker to "pass the authentication request to the original" and gain full MitM. Conditions: Public key authentication must be used for authentication. If it's possible to perform the attack passively(e.g on pcaps), it doesn't qualify. This attack has to affect setups using both the latest OpenSSH client and server with default configuration. This attack has to be able to be performed in realtime using the processing power of a 2015 macbook model of your choosing. This attack cannot rely on attacker having any other access but the ability to tamper with the connection however much he wants. This attack cannot rely on known flaws in the encryption algorithms. With full MitM I am referring to the ability to at least access the plaintext communications between the client and server. Eg if the user runs 'sudo', the ability to see the password entered. Please consider this offer legally binding, if you have any questions I will answer them and you can consider the answers binding too. Good luck.