3 ms·
What about the password you have entered before you press "enter" ? I think that's a more interesting question ... presumably most SSH users know not to connec
by rsync 10y ago
What about the password you have entered before you press "enter" ?
I think that's a more interesting question ... presumably most SSH users know not to connect when the server keys mismatch and you get the BIG NASTY WARNING.
However, let's say you connect properly to a host you typically use, but through inattention or confusion you start to enter a password for some other SSH host ... and then hit ctrl-C.
I think I have understood that the remote SSH server actually receives the keystrokes character by character, but does it decrypt that all at once after you hit enter, or is it decrypting the characters one by one ?
- protomikron 10y agoPlease correct me if I am wrong, but I would say you do not have to worry if you do not hit "Enter". In fact, I would say, that even the application, i.e. ssh doing the read(), does not see it, as sending CTRL-C (SIGINT) will destroy the process (ssh waiting for read() to return). Until that point your password is just in the tty's buffer - so you are save (if your local machine is not owned - but then you are screwed anyway).
- takeda 10y agoThe TTY is opened after you log in. When you are entering password, the characters are collected by the client and are sent after you press enter.
- GrinningFool 10y agoCharacter by character occurs only after a secure channel is established. The client program asks you for the password, in response to negotiations with the server. The password will be sent as a whole and not as typed, as part of the complete auth packet.[1] 1. https://www.ietf.org/rfc/rfc4252.txt https://www.ietf.org/rfc/rfc4252.txt - sections 5, 8