3 ms·
ssh is, by default, Trust on First Use which is a significantly different model than a Trusted Thirdparty (CAs). There are some well known trade-offs, namely t
by TheDong 9y ago
ssh is, by default, Trust on First Use which is a significantly different model than a Trusted Thirdparty (CAs).
There are some well known trade-offs, namely that having everyone manually verify fingerprints on initial connect and again on any server change is a large burden.
I don't particularly want to have to go into my bank's local office and verify in person the fingerprint is correct each time they need to rotate a secret.
If this isn't what you meant, that we should use TOFU vs Trusted third party, please do expand.
- thriftwy 9y agoI think it works much better for contacts. You have to verify contact once and then you are assured that it's still the same person.
- teraflop 9y ago> You have to verify contact once Only if users never replace their keys, which puts them at significant risk in the event of a key compromise.
- slrz 9y agoThey could just put the relevant information on all their communications, your credit card, statements and so on, also accounting for future rotations. For banks, it could work quite well. Most other people and organizations aren't that lucky, though.