5 ms·

Opportunistic encryption is generally a good idea, but as it has no feedback method you can't really be certain if it is working or not. The seamlessness works

Opportunistic encryption is generally a good idea, but as it has no feedback method you can't really be certain if it is working or not. The seamlessness works both ways.

gaius 18y ago
Right, but the current situation is silly. For example right now if I want to connect into work, I fire up the Cisco VPN client, then I ssh from my Mac to whatever Unix box I want to work on there. I'm not sure that "double encryption" really buys us anything here. Unless someone's actually in our datacentre tapping the wire coming out of the VPN host, in which case we've bigger problems...
- tptacek 18y ago
  The VPN is a policy tool, not a security tool. There are no good security tools for managing SSH sessions; you might as well just not have a firewall if you allow it in.
- devicenull 18y ago
  It's not really for the double encryption. It has a big advantage in that you don't need to open SSH up to the internet, only to your VPN server. Even though you may have perfectly secure passwords, why expose SSH to the internet if you don't have to?