4 ms·
They can still get you if you invoke SSH on the remote, as the password is sent to the remote machine one character at a time, then forwarded on to your ultimat
by theg5prank 13y ago
They can still get you if you invoke SSH on the remote, as the password is sent to the remote machine one character at a time, then forwarded on to your ultimate destination all at once.
- betterunix 13y agoGood point, though I imagine that this issue could be fixed in SSH as long as the password is not being echoed (which it should not be).
- msmith 13y agoIronically, I think it's actually slightly easier for an eavesdropper to detect that your keystrokes are part of a password if the password is not being echoed. They could potentially use this information to know the length of a password, which would make brute-forcing easier. A very hypothetical attack, but fun to think about! Less effective than a $5 wrench, no doubt.
- ddunkin 13y agoThat is what public key/agent forwarding is for. This will explain it better than I ever could: http://www.unixwiz.net/techtips/ssh-agent-forwarding.html http://www.unixwiz.net/techtips/ssh-agent-forwarding.html