3 ms·
In the real world, "trust on first use" is literally true - it's never "check on first use." SSHFP DNS records would help a lot, or some other scheme. For all o
by foobiekr 3y ago
In the real world, "trust on first use" is literally true - it's never "check on first use." SSHFP DNS records would help a lot, or some other scheme. For all of the positive image ssh has, mostly because telnet and ftp were so ridiculously terrible, ssh-as-used is pretty mediocre.
And the reality is: "No."
https://www.usenix.net/system/files/login/articles/105484-Gutmann.pdf https://www.usenix.net/system/files/login/articles/105484-Gu...
- MaxBarraclough 3y ago> it's never "check on first use." Personally I always manually check on first use, but I agree this puts me in a small minority. I said something similar in a comment last year. [0] It's unfortunate that the term TOFU is ambiguous. In practice it's used to refer to check on first use and blindly assume it's ok on first use. [0] https://news.ycombinator.com/item?id=30366424 https://news.ycombinator.com/item?id=30366424