3 ms·
I guess my hangup is, if the primary goal of this is to prevent drive-by port scanning, then that means implementing this on the public internet. And I cannot c
by ckozlowski 12y ago
I guess my hangup is, if the primary goal of this is to prevent drive-by port scanning, then that means implementing this on the public internet. And I cannot conceive of how you'd distribute a pre-shared key over that large a base and not 1. make it trivial to obtain your key and 2. Not create a massive headache for your users.
- shawnz 12y ago> [...] that means implementing this on the public internet. And I cannot conceive of how you'd distribute a pre-shared key over that large a base [...] Sure, the servers in question would have to be internet connected for this to be useful. But that doesn't mean they are open-access. If they were, of course it wouldn't make sense to use this. But consider, for example, that you are setting up a server at your organization to provide employees with remote access. Nobody but your employees need to have access, but it still must be internet visible. Wouldn't that be a good use case for this?
- ckozlowski 12y agoA VPN would be better then.
- shawnz 12y agoI am not suggesting to not use a VPN. But a VPN alone doesn't solve the visibility problem. Similar to port knocking, this would prevent anyone from knowing that the server even exists without knowing the IP and key in advance. This isn't an alternative to VPNs. In fact, as far as I'm concerned, this proposal is only useful when combined with a VPN!