This utility can only perform MitMs if the client doesn't correctly verify the server's identity - e.g. if the user doesn't verify the fingerprint during the fi

This utility can only perform MitMs if the client doesn't correctly verify the server's identity - e.g. if the user doesn't verify the fingerprint during the first connection, or they override the scary MitM warning. If the client correctly verifies the server's identity, then MitM is not possible. exabrial is referring to a mitigation that works even if the client doesn't correctly verify the server's identity. SSH actually does have this mitigation, but it doesn't fully prevent nastiness, as I explain here: https://news.ycombinator.com/item?id=29259981 https://news.ycombinator.com/item?id=29259981