3 ms·
what about PKI + password auth? user auth should be encrypted using server's public key
by flamedoge 10y ago
what about PKI + password auth? user auth should be encrypted using server's public key
- russell_h 10y agoIf I understand you correctly, that's basically how SSH already works. The problems are: 1. Most people don't bother to verify the host key of the server they are connecting to. 2. An attacker with root on the server can modify or observe sshd in order to get the plaintext password.