6 ms·
> If someone using SSH ignores the fact that the host key has changed Then it's game over regardless of anything else. That someone is now owned by anything an
by jjav 6y ago
> If someone using SSH ignores the fact that the host key has changed
Then it's game over regardless of anything else. That someone is now owned by anything and anyone who cares to MITM them.
- cthalupa 6y agoYes, it is an issue for sure. But it's also a world where people have grown accustomed to doing this - automatic scaling in the cloud with re-use of IPs means that systems come up with the same IP frequently, so people have gotten used to doing this. For the stuff I manage in the cloud I use their APIs to keep my known_hosts file up to date - if an IP got reused by an instance, I clear the entry in my known_hosts file. If it didn't, I would see the key change alert (verified by modifying the host key on the destination server)