3 ms·

> No they don't SSH into one of your boxes from my machine real quick.

boomlinde 5y ago
Of all the use cases I can imagine, enabling password logins just so I can meaningfully type my password into strange computers is among the least compelling.
reggegg 5y ago
What's the use case for using your personal unix account on someone else's computer?
- tedunangst 5y ago
  My mail server crashed while I was on vacation without my laptop.
- willcipriano 5y ago
  I've done it from work computers where the USB ports are disabled but I want to hit my personal dev machine at home to get at my notes and calendar. I've established impromptu SSH tunnels from other people's machines to my local network so that I could watch my media on their TV. If you dropped me naked on the other side of the planet I could get a copy of my identity documentation and access my email, bank accounts, etc from any internet connected machine I find.
  - tptacek 5y ago
    You get that passwords over first-time SSH from untrusted computers or untrusted networks aren't safe at all, right? That posting those passwords is literally a sport at hacker conferences, and has been for over 2 decades? This whole thread is a little alarming.
    - willcipriano 5y ago
      You get that waking outside isn't safe at all right? Mugging is as old as civilization and don't get me started on cars. Life is about trade offs, if someone really wants to spend the time to get access to my home dev box then I may have to spend a couple days on the phone with the bank and restoring from my offline backups. Big whoop. Your home is likely insecure from my standards. Do you have a firearm at the ready? Do you know how to use it? Does your family have codewords to communicate without letting others on to your plan? How hard is it to kick in your doors? Not just the front door, but the bedrooms. Do you have a dog to wake you in the night? How stocked are you, can you last a month with no resupply? Do you even have a panic room? I protect what matters beacuse you can't protect everything.
      - tptacek 5y ago
        How are we still talking about this? SSH doesn't work the way you appear to think it does. Passwords don't solve the first-use problem; in fact, the first-use problem makes passwords much less safe than keys.
        willcipriano 5y ago
        Yes and your cheap hollow core door doesn't solve the ending the life of everyone you care about problem. Why are you more concerned about passwords than that? I know the risks well, I don't find them to be worth the hassle of avoiding them.
    - getcrunk 5y ago
      Iirc ssh passwords aren't sent in the clear. Is that really the case? Edit: I looked it up to confirm. First time password is encrypted analogous to tls
      - tptacek 5y ago
        No, it's not analogous to TLS. TLS has trust anchors: the key exchange in a TLS handshake is secure, even on first contact with a server. The key exchange in a first-contact SSH handshake is trivially MITM'd. An attacker with control of your network (or, obviously, your machine) can simply steal your password.

Of all the use cases I can imagine, enabling password logins just so I can meaningfully type my password into strange computers is among the least compelling.

reggegg 5y ago

What's the use case for using your personal unix account on someone else's computer?

tedunangst 5y ago
My mail server crashed while I was on vacation without my laptop.
willcipriano 5y ago
I've done it from work computers where the USB ports are disabled but I want to hit my personal dev machine at home to get at my notes and calendar. I've established impromptu SSH tunnels from other people's machines to my local network so that I could watch my media on their TV. If you dropped me naked on the other side of the planet I could get a copy of my identity documentation and access my email, bank accounts, etc from any internet connected machine I find.
- tptacek 5y ago
  You get that passwords over first-time SSH from untrusted computers or untrusted networks aren't safe at all, right? That posting those passwords is literally a sport at hacker conferences, and has been for over 2 decades? This whole thread is a little alarming.
  - willcipriano 5y ago
    You get that waking outside isn't safe at all right? Mugging is as old as civilization and don't get me started on cars. Life is about trade offs, if someone really wants to spend the time to get access to my home dev box then I may have to spend a couple days on the phone with the bank and restoring from my offline backups. Big whoop. Your home is likely insecure from my standards. Do you have a firearm at the ready? Do you know how to use it? Does your family have codewords to communicate without letting others on to your plan? How hard is it to kick in your doors? Not just the front door, but the bedrooms. Do you have a dog to wake you in the night? How stocked are you, can you last a month with no resupply? Do you even have a panic room? I protect what matters beacuse you can't protect everything.
    - tptacek 5y ago
      How are we still talking about this? SSH doesn't work the way you appear to think it does. Passwords don't solve the first-use problem; in fact, the first-use problem makes passwords much less safe than keys.
      - willcipriano 5y ago
        Yes and your cheap hollow core door doesn't solve the ending the life of everyone you care about problem. Why are you more concerned about passwords than that? I know the risks well, I don't find them to be worth the hassle of avoiding them.
  - getcrunk 5y ago
    Iirc ssh passwords aren't sent in the clear. Is that really the case? Edit: I looked it up to confirm. First time password is encrypted analogous to tls
    - tptacek 5y ago
      No, it's not analogous to TLS. TLS has trust anchors: the key exchange in a TLS handshake is secure, even on first contact with a server. The key exchange in a first-contact SSH handshake is trivially MITM'd. An attacker with control of your network (or, obviously, your machine) can simply steal your password.