4 ms·
The proper defense is to not use passwords. It's 2019, nobody should be using passwords on SSH-enabled shell accounts. Heck, I use secure tokens for authentica
by wahern 7y ago
The proper defense is to not use passwords. It's 2019, nobody should be using passwords on SSH-enabled shell accounts.
Heck, I use secure tokens for authentication so this memory encryption hack is useless to me--even I don't know what my private key(s) are, nor does OpenSSH or any other software on my computers. But I appreciate that we're a long way from ubiquitous hardware-based authentication.
- gnur 7y agoAfter you are connected you might still want to enter a password (for sudo perhaps).
- rphlx 7y agoThe solution there is to have the app use line buffering rather than a "raw" term mode that exposes inter-char timing on the network. How widely that's followed in practice, I do not know, but one would certainly hope that sudo does it.