3 ms·

A band-aid, I'm afraid. Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just as

A band-aid, I'm afraid. Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Many SSH clients don't even support it, at all. PuTTY and almost anything that uses SSH for tunneling. When they do: how many of your hosts do you know the image of? Again: nice idea, but utterly impotent in our universe. Compare to the efficiency of e.g. WPA2 keys: less theoretically beautiful, but much more efficient with humans.

ryanlol 11y ago
>Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Probably not very many, but it's really only useful for people that ignore basic security features anyway. (Key auth) >When they do: how many of your hosts do you know the image of? None, I use key auth like any reasonable person would.
- nothrabannosir 11y ago
  Does key auth protect you from a MITM on the first connection? That is, key auth as reasonable people use it, as you said. And this: > but it's really only useful for people that ignore basic security features anyway. (Key auth) is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right". And these are people who use SSH to begin with. Not typically technologically illiterate, I would guess. If they can't even be arsed to use "basic security features", what good is this system, then? Again: there is a way to use SSH properly, yes. But rare is the person who does this. (But key auth is orthogonal to host fingerprinting anyway, this is kind of a red herring)
  - ryanlol 11y ago
    >Does key auth protect you from a MITM on the first connection? Yes. Key auth will protect you from your SSH connection being listened to, and will make credential theft reliant on social engineering. However, someone could still pretend to be the server (potentially stealing your commands), but there really doesn't exist any way to solve that. >is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right". Nothing works for those people, at least generally with SSH users you can assume that they should know better. >Again: there is a way to use SSH properly, yes. But rare is the person who does this. I'd hardly consider SSH key auth users rare. >(But key auth is orthogonal to host fingerprinting anyway, this is kind of a red herring) But it almost completely fixes the main problem caused by MitM, someone gaining access to the server you're logging into.

ryanlol 11y ago

>Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Probably not very many, but it's really only useful for people that ignore basic security features anyway. (Key auth) >When they do: how many of your hosts do you know the image of? None, I use key auth like any reasonable person would.

nothrabannosir 11y ago
Does key auth protect you from a MITM on the first connection? That is, key auth as reasonable people use it, as you said. And this: > but it's really only useful for people that ignore basic security features anyway. (Key auth) is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right". And these are people who use SSH to begin with. Not typically technologically illiterate, I would guess. If they can't even be arsed to use "basic security features", what good is this system, then? Again: there is a way to use SSH properly, yes. But rare is the person who does this. (But key auth is orthogonal to host fingerprinting anyway, this is kind of a red herring)
- ryanlol 11y ago
  >Does key auth protect you from a MITM on the first connection? Yes. Key auth will protect you from your SSH connection being listened to, and will make credential theft reliant on social engineering. However, someone could still pretend to be the server (potentially stealing your commands), but there really doesn't exist any way to solve that. >is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right". Nothing works for those people, at least generally with SSH users you can assume that they should know better. >Again: there is a way to use SSH properly, yes. But rare is the person who does this. I'd hardly consider SSH key auth users rare. >(But key auth is orthogonal to host fingerprinting anyway, this is kind of a red herring) But it almost completely fixes the main problem caused by MitM, someone gaining access to the server you're logging into.