2 ms·
I'll be honest, I have never spent effort on a host key that had changed unexpectedly, and at least a few have.
by jrochkind1 1y ago
I'll be honest, I have never spent effort on a host key that had changed unexpectedly, and at least a few have.
- kragen 1y agoI've often called people on the phone and stuff. It depends somewhat on what's at stake. Authenticating users with SSH passwords puts much more at stake than using public keys, since an attacker who can get you to send your unencrypted password to a malicious server once can steal your account; deploying PAKE algorithms (successors to SRP, see https://eprint.iacr.org/2021/1492.pdf https://eprint.iacr.org/2021/1492.pdf) could mitigate that, but I don't think any shipped SSH version has ever supported a PAKE algorithm.