4 ms·
I agree that the utility of this feature would be limited to a small percent of users for a small percent of cases. The SSH example comes to mind because that
by saas_co_de 9y ago
I agree that the utility of this feature would be limited to a small percent of users for a small percent of cases.
The SSH example comes to mind because that is a system that does something similar.
In my experience every single SSH error on a key change has been a false positive but everyone accepts the high false positive rate because it is worth it to detect that one case where you are actually compromised.
- daira 9y agoBut you don't detect that one case where you are actually compromised. You dismiss it like you do all the false positives. At best, when you get pwned you think back to having dismissed the key change warning and know what happened, but how does that actually help you?
- scott00 9y agoI actually caught a semi-real one once. My new employer was MITMing all ssh traffic.
- saas_co_de 9y agothis does not follow at all. any time a cert has changed i either know the cause or verify the cause before using the server.