3 ms·
That's mostly security by obscurity, in which you're bound to get burned.
by artmageddon 16y ago
That's mostly security by obscurity, in which you're bound to get burned.
- JonnieCache 16y agoCould you elaborate?
- jrockway 16y agoThe security of that system comes from hoping nbobody will guess your key exchange protocol. The security in real key exchange protocols comes from mathematics problems that would take more computer power than the universe has available to solve. So 'your way' is clearly inferior; the attacker guesses (or is told) that ROT13 is what's going on, and you're 0wned and you will never know. Problem.
- JonnieCache 16y agoYeah this is really obvious now. When I wrote that, I didn't make the mental comparison to PGP or similar; obviously that provides actual cryptography with essentially the same information-exchange workflow. Nothing educates like brainstorming in public and being shot down by experts, thanks :)
- deno 16y agoThough it could be effective, assuming attacker WILL try non-translated version first. Basically run honeypot on default password: if successful login attempt then go into panic mode. But seriously, the only password in SSH auth procedure should be the one you decode your private key with.