> I think you've misunderstood the issue a little bit. I might be misunderstanding this. How does .bashrc get replaced in that example? You mean the hijacked r

> I think you've misunderstood the issue a little bit. I might be misunderstanding this. How does .bashrc get replaced in that example? You mean the hijacked remote returns .bashrc instead of boring-spreadsheet.ods? That means it is only a problem if you are in $HOME (but still a problem). Further, how does the remote complete the SSL handshake if it doesn't have the private key, and if it does, isn't that a bigger problem?