5 ms·

SSH gets this right No, it doesn't. When was the last time you verified a host key out of band? And if you're using SSH, you know well enough to know why you

SSH gets this right No, it doesn't. When was the last time you verified a host key out of band? And if you're using SSH, you know well enough to know why you should do the damn legwork to verify the key. What do you expect for end users? Furthermore, if nobody is doing out of band verification on the first pass, how do you expect users to distinguish between an attack and legit host key change?

rwmj 11y ago
As I said above: Sure, this isn't super-secure for first time visitors to their banking website. But it's fine for the common case where someone tries to MITM you when you move from your home to a coffee shop or vice versa and you're just browsing sites that would otherwise be using http.
ryanlol 11y ago
But the worst case scenario with SSH MitM isn't someone being able to eavesdrop on your connection. But someone pretending to be the server, which is hardly as serious. (Unless you're using password auth, in which case you deserve to get owned)
- icebraining 11y ago
  If someone impersonates your server, it can then pass the authentication request to the original, and gain full MITM without your knowledge. Yes, even if you use public key auth.
  - ryanlol 11y ago
    I will personally pay you the sum of 500 Bitcoins if you can demonstrate a realistic active MitM attack on OpenSSH that allows an active network level attacker to "pass the authentication request to the original" and gain full MitM. Conditions: Public key authentication must be used for authentication. If it's possible to perform the attack passively(e.g on pcaps), it doesn't qualify. This attack has to affect setups using both the latest OpenSSH client and server with default configuration. This attack has to be able to be performed in realtime using the processing power of a 2015 macbook model of your choosing. This attack cannot rely on attacker having any other access but the ability to tamper with the connection however much he wants. This attack cannot rely on known flaws in the encryption algorithms. With full MitM I am referring to the ability to at least access the plaintext communications between the client and server. Eg if the user runs 'sudo', the ability to see the password entered. Please consider this offer legally binding, if you have any questions I will answer them and you can consider the answers binding too. Good luck.
    - rdl 11y ago
      You're exempting the obvious "MITM on initial connection" attack, right?

rwmj 11y ago

As I said above: Sure, this isn't super-secure for first time visitors to their banking website. But it's fine for the common case where someone tries to MITM you when you move from your home to a coffee shop or vice versa and you're just browsing sites that would otherwise be using http.

ryanlol 11y ago

But the worst case scenario with SSH MitM isn't someone being able to eavesdrop on your connection. But someone pretending to be the server, which is hardly as serious. (Unless you're using password auth, in which case you deserve to get owned)

icebraining 11y ago
If someone impersonates your server, it can then pass the authentication request to the original, and gain full MITM without your knowledge. Yes, even if you use public key auth.
- ryanlol 11y ago
  I will personally pay you the sum of 500 Bitcoins if you can demonstrate a realistic active MitM attack on OpenSSH that allows an active network level attacker to "pass the authentication request to the original" and gain full MitM. Conditions: Public key authentication must be used for authentication. If it's possible to perform the attack passively(e.g on pcaps), it doesn't qualify. This attack has to affect setups using both the latest OpenSSH client and server with default configuration. This attack has to be able to be performed in realtime using the processing power of a 2015 macbook model of your choosing. This attack cannot rely on attacker having any other access but the ability to tamper with the connection however much he wants. This attack cannot rely on known flaws in the encryption algorithms. With full MitM I am referring to the ability to at least access the plaintext communications between the client and server. Eg if the user runs 'sudo', the ability to see the password entered. Please consider this offer legally binding, if you have any questions I will answer them and you can consider the answers binding too. Good luck.
  - rdl 11y ago
    You're exempting the obvious "MITM on initial connection" attack, right?