4 ms·
> on a machine you have connected to Don't you have to be actively connected to the machine for this to work? i.e. the server I haven't connected to for a few
by btown 12y ago
> on a machine you have connected to
Don't you have to be actively connected to the machine for this to work? i.e. the server I haven't connected to for a few months has no way of opening connections on my behalf at this point, right?
- beagle3 12y agoYou are right. But once you connect, a year later - in those 3 minutes before you disconnect, the attacker might have authenticated as yourself to 100 other machines -- and appended their own key to .ssh/authorized_keys on these machines, so that the compromise no longer needs you to be connected.
- dsl 12y agoYou are correct. That is what I meant, but I should have said "a machine you are actively connected to."