2 ms·
You're assuming everything is properly configured. A bug-free setup is essentially impossible. The claim is that obfuscation makes it less likely that a mista
by omginternets 10y ago
You're assuming everything is properly configured. A bug-free setup is essentially impossible.
The claim is that obfuscation makes it less likely that a mistake will be spotted by an attacker.
To be clear, I agree with you to the extent that a properly configured SSH server with good keys and no 0-day exploit is more effective than what I'm proposing. My point is rather that such a setup makes a lot of assumptions (key exchange, configuration, secure updates, etc...) and that obfuscation is a complementary security layer for when those things occasionally fail.
- tptacek 10y ago"A bug free setup"? Don't use passwords. Done.
- omginternets 10y agoCome on, now I'm starting to suspect you're commenting in bad faith. Just to reiterate, SSH was an example of the general problem that is misconfigured/buggy software. OpenSSH is certainly one of the most secure programs I'm aware of, but the same can't be said for things like wordpress. Eventually, something gets messed up (if only momentarily), and being nonstandard makes you less susceptible to scripted breaches. We can debate whether the tradeoff is worthwhile (and in many cases it's not), but it's a valid gosh-darn secruity layer!
- tptacek 10y agoIf you can't deploy passwordless SSH, you have problems port-knocking can't solve.
- omginternets 10y agoI'm at a loss for words. I implore you to re-read this comment thread and try to understand what I'm saying. You're responding to an argument I haven't made.