7 ms·
Or, have an agreement that all password resets will be silently ROT13'd against what is requested. So if you say "Can you reset my password to foobar" then you
by JonnieCache 16y ago
Or, have an agreement that all password resets will be silently ROT13'd against what is requested.
So if you say "Can you reset my password to foobar" then your admin knows to actually set it to "sbbone."
They can then just send a normal reply saying "ok your password has been set to 'foobar'" and then as long as both parties remember the secret protocol, you are OK.
You could then also watch for login attempts using "foobar" to warn you of foul play.
- artmageddon 16y agoThat's mostly security by obscurity, in which you're bound to get burned.
- JonnieCache 16y agoCould you elaborate?
- jrockway 16y agoThe security of that system comes from hoping nbobody will guess your key exchange protocol. The security in real key exchange protocols comes from mathematics problems that would take more computer power than the universe has available to solve. So 'your way' is clearly inferior; the attacker guesses (or is told) that ROT13 is what's going on, and you're 0wned and you will never know. Problem.
- JonnieCache 16y agoYeah this is really obvious now. When I wrote that, I didn't make the mental comparison to PGP or similar; obviously that provides actual cryptography with essentially the same information-exchange workflow. Nothing educates like brainstorming in public and being shot down by experts, thanks :)
- deno 16y agoThough it could be effective, assuming attacker WILL try non-translated version first. Basically run honeypot on default password: if successful login attempt then go into panic mode. But seriously, the only password in SSH auth procedure should be the one you decode your private key with.