3 ms·

port knocking is just, another way of doing a password, right? It's pretty much just a PIN code with a slightly obscure method of inputting the digits. I would

by jonfw 6y ago

port knocking is just, another way of doing a password, right? It's pretty much just a PIN code with a slightly obscure method of inputting the digits. I would imagine that this is open for a man in the middle attack- if this traffic were intercepted- you'd be able to see port numbers, right?

outworlder 6y ago
Well, yes. But where would the attacker be if they are in a position to intercept the traffic? The answer to that may dictate if the technique would have value for you.
- jonfw 6y ago
  I'm just saying that port knocking just results in another secret you have to manage. It's just adding another locked door. Why use a locked door that's a pain in the ass and insecure in transit? If you want two layers of secret-based auth- why would you make your second layer one that's objectively less secure and more unwieldy than other layers?
dec0dedab0de 6y ago
if this traffic were intercepted- you'd be able to see port numbers, right? Sure but I hope the service you're opening up with the knock is actually secure like ssh. The idea is just that you cant portscan to find something to attack. Its basically the same reasoning behind using non standard ports, but takes it a bit further.
- jonfw 6y ago
  The non-standard port is of trivial value, but it's practically zero cost- that's why it's used. Port knocking doesn't have that benefit- you're establishing another secret that has to be maintained and accessed- but unlike key based auth or passwords- that secret is insecure in transit and unwieldy to use. If you want to add another layer and manage another secret- why not just add another layer of the lower-friction and more secure methods we already use to establish secret-based auth?
  - TillE 6y ago
    Which comes all the way around to: a VPN sounds like a better option in every respect. More secure, universally supported. I think the main reason you'd use port knocking is because it's fun and cool.

by jonfw 6y ago

outworlder 6y ago

Well, yes. But where would the attacker be if they are in a position to intercept the traffic? The answer to that may dictate if the technique would have value for you.

jonfw 6y ago
I'm just saying that port knocking just results in another secret you have to manage. It's just adding another locked door. Why use a locked door that's a pain in the ass and insecure in transit? If you want two layers of secret-based auth- why would you make your second layer one that's objectively less secure and more unwieldy than other layers?

dec0dedab0de 6y ago

if this traffic were intercepted- you'd be able to see port numbers, right? Sure but I hope the service you're opening up with the knock is actually secure like ssh. The idea is just that you cant portscan to find something to attack. Its basically the same reasoning behind using non standard ports, but takes it a bit further.

jonfw 6y ago
The non-standard port is of trivial value, but it's practically zero cost- that's why it's used. Port knocking doesn't have that benefit- you're establishing another secret that has to be maintained and accessed- but unlike key based auth or passwords- that secret is insecure in transit and unwieldy to use. If you want to add another layer and manage another secret- why not just add another layer of the lower-friction and more secure methods we already use to establish secret-based auth?
- TillE 6y ago
  Which comes all the way around to: a VPN sounds like a better option in every respect. More secure, universally supported. I think the main reason you'd use port knocking is because it's fun and cool.