3 ms·

I think caution is good, but I am not sure "Don't use it" is a fair assessment for all use cases given Mosh's technology and track record over the years. Of co

I think caution is good, but I am not sure "Don't use it" is a fair assessment for all use cases given Mosh's technology and track record over the years. Of course SSH is more battle tested but, Mosh has a FAQ entry just for this concern: "In one concrete respect, the Mosh protocol is more secure than SSH's: SSH relies on unauthenticated TCP to carry the contents of the secure stream. That means that an attacker can end an SSH connection with a single phony "RST" segment. By contrast, Mosh applies its security at a different layer (authenticating every datagram), so an attacker cannot end a Mosh session unless the attacker can continuously prevent packets from reaching the other side. A transient attacker can cause only a transient user-visible outage; once the attacker goes away, Mosh will resume the session." "However, in typical usage, Mosh relies on SSH to exchange keys at the beginning of a session, so Mosh will inherit the weaknesses of SSH—at least insofar as they affect the brief SSH session that is used to set up a long-running Mosh session." Also see, "Q: What is Mosh's security track record so far?" here: https://mosh.mit.edu/#faq https://mosh.mit.edu/#faq

zobzu 10y ago
Mosh requires OpenSSH to run so no matter what, using Mosh is ALWAYS less safe than OpenSSH alone since all it does is add functionality on top. Now, I wrote a 3DES-telnet tool back in 1996 and it has zero security vulnerability. That's 20 years. Safe as hell! Yeah exactly. Everyone uses OpenSSH. Very few use Mosh. Invalid comparison.
- justizin 10y ago
  > Mosh requires OpenSSH to run so no matter what, using Mosh is ALWAYS less safe than OpenSSH alone since all it does is add functionality on top. Not sure I'd agree with this, since after initial session establishment, it completely replaces the functionality of OpenSSH in a way that guards against privilege escalation and authenticates every packet. I do agree that there are some concerns with how 'battle tested' it is, but not sure I believe this about "audits" since, I mean, the entire world was using OpenSSL to build the entire internet for ages and we just found out it was one guy scraping through the bug tracker for far too long. The model of mosh is more secure than SSH, though its' session resumption could potentially expose a hole if someone has your token and session keys, they can resume your session.

zobzu 10y ago

Mosh requires OpenSSH to run so no matter what, using Mosh is ALWAYS less safe than OpenSSH alone since all it does is add functionality on top. Now, I wrote a 3DES-telnet tool back in 1996 and it has zero security vulnerability. That's 20 years. Safe as hell! Yeah exactly. Everyone uses OpenSSH. Very few use Mosh. Invalid comparison.

justizin 10y ago
> Mosh requires OpenSSH to run so no matter what, using Mosh is ALWAYS less safe than OpenSSH alone since all it does is add functionality on top. Not sure I'd agree with this, since after initial session establishment, it completely replaces the functionality of OpenSSH in a way that guards against privilege escalation and authenticates every packet. I do agree that there are some concerns with how 'battle tested' it is, but not sure I believe this about "audits" since, I mean, the entire world was using OpenSSL to build the entire internet for ages and we just found out it was one guy scraping through the bug tracker for far too long. The model of mosh is more secure than SSH, though its' session resumption could potentially expose a hole if someone has your token and session keys, they can resume your session.