lvh

69 ms·

841.
by lvh 8y ago
I’m not sure I understand the question: most places where you try a password you don’t get an offline MD5-speed oracle. So two ways: it’s faster than say cracking a PBKDF2 dump, and it’s offline, unlike, I dunno, a web password prompt. You
842.
by lvh 8y ago
Do you have evidence that passwords for SSH keys are as good as you claim?
843.
by lvh 8y ago
The blog post explicitly addresses this, but you don’t seem to interact with its point. We have evidence that smash and grab attacks exist, and since they affect more people, you’re more likely to get screwed by something like the recent es
844.
by lvh 8y ago
That’s right: the number of keys you can store on it is limited. That’s one of the reasons we think you should just use them for identity, not temporary authorization.
845.
by lvh 8y ago
Whoops; my bad!
846.
by lvh 8y ago
You're right that shitty systems train users to be phishable -- by typing their password all over the place -- all the time, not even counting the poor default password hygiene most users have. This is one of the reasons U2F/WebAu
847.
by lvh 8y ago
I think the easiest way to get started is to deploy Teleport or BLESS.
848.
by lvh 8y ago
I like Teleport. It's not an SSO implementation but if you pay Gravitational you get SAML. BLESS, the Netflix solution, relies on you being able to call a Lambda. You can SSO that as well via STS' AssumeRoleWithSAML. (But be caref
849.
by lvh 8y ago
Don't do this. Get an SSH CA and temporary credentials, and make your authentication to that SSH CA actually good (e.g. SAML with mandatory U2F).
850.
by lvh 8y ago
My bad: remote code execution.
851.
by lvh 8y ago
Good for you -- but I hope you'll agree that even 4*rand(10k) is a pretty gracious assumption for password quality. The argument is not "under literally all circumstances is it worse", but just rather, "it's worse&q
852.
by lvh 8y ago
You use SSO with strong authentication to sign a temporary credential for SSH.
853.
by lvh 8y ago
Backwards compatibility. I don’t think it shelled out, but close enough.
854.
by lvh 8y ago
‘tqbf is responsible for that one :)
855.
by lvh 8y ago
Look, 2048 is fine. Assuming no algorithmic speeduos you get 112 bits of security and that’s plenty. But SSH keys are only used to sign: they don’t affect bulk encryption. 4096’s performance is not what’s holding you back.
856.
by lvh 8y ago
I don’t think we actually disagree; I said “a lot less fucked” not “great” :) you can get real AEADs with Ed25529 in SSH easily; and some of the dumb options problems may still apply with Oxy, depending on what you’re taking about.
857.
by lvh 8y ago
Not really. Most dependencies get RCE one way or another, just not necessarily at installation.
858.
by lvh 8y ago
Oxy is trying: https://github.com/oxy-secure/oxy But it’s important to remember that SSH is a lot less fucked overall than the VPN situation was. People mostly grok SSH. SSH mostly doesn’t negotiate BF-CBC.
859.
by lvh 8y ago
If you select from a 10k word list, you get 13.3 bits of entropy per word. 4 of those get you 53 bits of entropy. One p3.16xlarge does 450GH/s. So, as a first order approximation: 2 53 / (450E9) = 2E4 or about 6 hours. Sure: you
860.
by lvh 8y ago
There’s also BLESS and Hashicorp Vault. I have a penchant for Teleport.
861.
by lvh 8y ago
You raise a bunch of valid points. Just to answer the one about authing against the CA (I'm in the LV airport for BlackHat and my laptop battery is about to die): yes, still get U2F tokens. You're right that malicious Chrome exten
862.
by lvh 8y ago
Nope! Ed25519 is great and honestly I think the compatibility concerns are overblown. It was introduced in 2014. If you are running four year old SSH you have other problems, like probably RHEL or some nonsense. That said: Ed25519 is a loca
863.
by lvh 8y ago
The new format has been around for a pretty long while (2013). I think it makes sense to upgrade to -o. While it's obvious to developers (I hope!) it's not obvious to most end users I think :)
864.
by lvh 8y ago
How does it "easily beat" a CA? It's still a long-held credential that you now have to manage across a fleet instead of a single SSH CA. You can get that short-term credential via a long-held key; that long-held key can even
865.
by lvh 8y ago
And a mere four years later they added a format that uses bcrypt... in a PBKDF2 construction? (I haven't found a motivation why, though Ted Unangst's post on it just says "I know about scrypt".)
866.
by lvh 8y ago
I explicitly raise that point in the post. Hardening one aspect of something does not preclude you from hardening others. Also: if I was trying to somehow draw attention away from that fact, I probably wouldn't write a blog post that m
867.
by lvh 8y ago
I wrote this; happy to answer questions.
868.
by lvh 8y ago
Yep; though the usual corollary is also that you'd cancel a bunch of other welfare programs -- that is: you're replacing benefits with UBI, not just tacking UBI on. (Not advocating for it; just saying that 70% of tax revenues make
869.
by lvh 8y ago
Same source also has as-percentage of GDP figures, and while it does move the US more towards the middle, it doesn’t refute GPs point that the US spends a lot on schools. Perhaps it is distributed inefficiently or inequitably, but that wasn
870.
by lvh 8y ago
And it looks like the server may have run out of files (well, descriptors) :-) google cache link: https://webcache.googleusercontent.com/search?q=cache:L6aopS...

More ›