4 ms·

This is a very bad idea. If I suspect you're doing this, I can definitely probe 30k ports silently within a second. How many tries do you think I need to break

by geocar 10y ago

This is a very bad idea. If I suspect you're doing this, I can definitely probe 30k ports silently within a second. How many tries do you think I need to break the last two digits?

MichaelBurge 10y ago
The very description of the project says "Take security by obscurity to the next level (You must be insane to run this)", so I'm not sure why you're trying to convince the author here.
developer2 10y ago
a) It's not explicitly said that the ssh password is the last digits from the code. That's the intuition I got as well, but that would be pure craziness. I assume only the port is affected, and you're using your normal authentication scheme (key or password) to login. b) Straight from the GitHub's README, which was not edited after submission to HN: >> Beware, currently I would not really recommend running this software, it was only written as a joke.
- dexterdog 10y ago
  I didn't think he meant getting the password which won't do you any good without the private key. I thought he meant getting the last 2 digits so you could start recording a pattern and eventually determine the 2FA key.
dexterdog 10y ago
Can't a scan like that be detected by a simple firewall?
brudgers 10y ago
Two men walking in the woods enter grizzly country. One stops and swaps his hiking boots for running shoes. The other says, that's stupid, you'll never out run a grizzly bear. The technical concerns fall under the category of security. The business concerns fall under risk mitigation. These concerns converge as the value of an enterprise's assets rises. Banks and blogs are toward different ends of the spectrum. At the lower end, this sort of measure probably keeps a wordpress site in the middle of the herd when wolves invite themselves to dinner.
- gist 10y ago
  > The other says, that's stupid, you'll never out run a grizzly bear. (For those who don't know the punchline of this is "I don't have to outrun the bear I just have to outrun you")

by geocar 10y ago

This is a very bad idea. If I suspect you're doing this, I can definitely probe 30k ports silently within a second. How many tries do you think I need to break the last two digits?

MichaelBurge 10y ago

The very description of the project says "Take security by obscurity to the next level (You must be insane to run this)", so I'm not sure why you're trying to convince the author here.

developer2 10y ago

a) It's not explicitly said that the ssh password is the last digits from the code. That's the intuition I got as well, but that would be pure craziness. I assume only the port is affected, and you're using your normal authentication scheme (key or password) to login. b) Straight from the GitHub's README, which was not edited after submission to HN: >> Beware, currently I would not really recommend running this software, it was only written as a joke.

dexterdog 10y ago
I didn't think he meant getting the password which won't do you any good without the private key. I thought he meant getting the last 2 digits so you could start recording a pattern and eventually determine the 2FA key.

dexterdog 10y ago

Can't a scan like that be detected by a simple firewall?

brudgers 10y ago

Two men walking in the woods enter grizzly country. One stops and swaps his hiking boots for running shoes. The other says, that's stupid, you'll never out run a grizzly bear. The technical concerns fall under the category of security. The business concerns fall under risk mitigation. These concerns converge as the value of an enterprise's assets rises. Banks and blogs are toward different ends of the spectrum. At the lower end, this sort of measure probably keeps a wordpress site in the middle of the herd when wolves invite themselves to dinner.

gist 10y ago
> The other says, that's stupid, you'll never out run a grizzly bear. (For those who don't know the punchline of this is "I don't have to outrun the bear I just have to outrun you")