6 ms·
I kind of wish we went to the SSH model, where you accept the identity of all servers you visit, and you get loud warnings whenever the identity changes. But e
by gcr 14y ago
I kind of wish we went to the SSH model, where you accept the identity of all servers you visit, and you get loud warnings whenever the identity changes.
But even that has huge problems. (For example, who ever double-checks their SSH server fingerprints in their known_hosts file?)
- caf 14y agoYou can implement that by installing the CertificatePatrol addon for Firefox.
- mpyne 14y agoThat's mostly what certificate pinning does already, if I'm understanding the concept right.
- uiri 14y agoThat's what SSHFP records are for. You store the fingerprint of the SSH server in DNS and then turn on a setting in your ~/.ssh/config and it will check for you if it matches with DNS when you try to connect. Even without DNSSEC it creates another thing which needs to be spoofed.