4 ms·

That's nice and all, but as TFA already mentions, ssh has a large attack surface. The most critical one though is that you usually grant people access to a shel

by deng 2y ago

That's nice and all, but as TFA already mentions, ssh has a large attack surface. The most critical one though is that you usually grant people access to a shell, so if an account gets breached, you need to worry about local root exploits, which are actually pretty common. Also, believe it or not, setting up key-based authentication is quite the challenge for a lot of people, especially if you demand encryption of the private key and setting up an agent. However, you cannot enforce private key encryption server-side, so you can't even guarantee some kind of 2FA is in place. Yes, ssh does nowadays support FIDO, but that's even more complicated for users...

pxc 2y ago
> However, you cannot enforce private key encryption server-side If you could do this, how would it work? If you could use the -sk key types or something similar with devices that are built into most computers (like TPM or the Secure Enclave) that would be nice. > you can't even guarantee some kind of 2FA is in place. Yes, ssh does nowadays support FIDO, but that's even more complicated for users... Can't you limit the allowable keytypes to those FIDO ones (currently ecdsa-sk and ed25519-sk)? There's also the old ChallengeResponseAuthentication stuff.