4 ms·
To be clear, that would be a privacy issue (a malicious server could tell what keys you have), but wouldn't allow a malicious server to log in to anything else
by XMPPwocky 6y ago
To be clear, that would be a privacy issue (a malicious server could tell what keys you have), but wouldn't allow a malicious server to log in to anything else with your keys. You don't send the private key when you log in.
- fhqghds 6y agoNote that GP said -A -- this means the agent gets forwarded, and processes on the malicious server can ask the agent to perform authentication operations. Touch to auth means the agent (or hardware token) asks the user to to confirm they are expecting an authentication request to come in. This allows you to forward your agent to a host and have slightly more protection against malicious processes on the host using your key.