4 ms·

So, how do I make sure my connection isn't MITM-ed? There is no server host key anywhere to compare. No CA certificate support. Doesn't look like ed25519 is sup

by hrez 8y ago

So, how do I make sure my connection isn't MITM-ed? There is no server host key anywhere to compare. No CA certificate support. Doesn't look like ed25519 is supported either. Somehow people don't use self-signed certificates all over the web but for sftp it's "fine" apparently.

sk5t 8y ago
For SSH (+SFTP) you are expected/obligated/etc. to have some way to verify the correct host key. There is no relationship to the clusterfudge of public CAs. Nor are there x509 certs.
- hrez 8y ago
  But you can't verify it since there is no host key published for sftp service (at least in AWS console).
jiveturkey 8y ago
thank you for the dose of reality.