111–119 of 119 posts
Earlier quoted context omitted.
> Also, if someone wanted to "shed" the identity associated with a public key they could always just "accidentally" leak the private key in a public git commit. That would allow anyone to prove that they owned the public key, which prevents the original owner from using it. But it seems like, if you want to stop using the key, it's simpler to just stop using it. What does leaking the private key accomplish that delet…
Plausible deniability.
Earlier quoted context omitted.
In fairness isn't that a result of your relationship with your isp? If you remain because of price or no other services available why wouldn't you use a vpn knowing your isp is a hostile actor and probably trying to deeply inspect packets, etc?
Because if you use HTTP over VPN, then you really have to trust your VPN provider. Why should you do that?
Your isp knows you visited a certain domain with https. That's a concern.
Earlier quoted context omitted.
In fairness isn't that a result of your relationship with your isp? If you remain because of price or no other services available why wouldn't you use a vpn knowing your isp is a hostile actor and probably trying to deeply inspect packets, etc?
>isn't that a result of your relationship with your isp? Any ISP is allowed to sniff and manipulate packets, so this isn't just about my ISP -- it's the server's ISP as well as any entities in-between. Even if I did (assuming that I reasonably could!) change my ISP, that's changing only one of the potentially many hostile actors. >why wouldn't you use a vpn That would require me to trust the connection between the VP…
A vpn moves any legal situation into a country with different laws.
Earlier quoted context omitted.
Note that they could only log back into your machine if you use the same credentials to between machines. This is one of the arguments for generating a unique SSH key on each machine you use. It makes it far harder to break in if you mess up somewhere along the way.
Not necessarily. If you have multiple keys active in local your SSH Agent, then connect to a malicious host with Agent Forwarding enabled, the malicious host could try to connect to to a third host and I believe it will try to use all active keys from the local agent.
Of course there's a list of common services that you could probably try and they could gain access there like say push/pull on github/gitlab however as long as those common services have another layer of protection (i.e. mandatory commit signing) it should limit the effective attack area pretty effectively.
I also generally find that ssh connections will be one way (i.e. you typically only set up SSH authentication to flow in a specific direction). As long as your SSH authentication graph is directed and acyclic (i.e. no loops and connections only go in one direction), there is little ability for a malicious server to access other nodes in the SSH auth graph provided you connect from a leaf or near leaf node.
I don't use agent forwarding because of the issues with it but there are definitely ways to reduce the attack area that it provides.
Earlier quoted context omitted.
Because if you use HTTP over VPN, then you really have to trust your VPN provider. Why should you do that?
You can be your own vpn provider if thats a big concern. Your isp knows you visited a certain domain with https. That's a concern.
You just shift the trust around. Now I have to trust the hoster, e.g. OVH instead of my local ISP. Really the best thing you can do is end-to-end encryption, don't send plaintext over the internet.
> Your isp knows you visited a certain domain with https. That's a concern.
How about DNS over HTTPS?
And here I thought this was for applying for jobs :( For people like me who live in SSH and C. Sadly, it appears to be some sort of MUD with a slack channel. Oh well.
And here I thought this was for applying for jobs :( For people like me who live in SSH and C. Sadly, it appears to be some sort of MUD with a slack channel. Oh well.
Hi, I'm a not native English speaker. I can't understand what do you mean with the word "MUD". Can you explain it for me? Thank you.
Any reason why this wasn't implemented with telnet since no authentication is required?
telnet is not shipped in the box on Windows and macOS, ssh is.
However, there are many versions of Windows which do not ship with ssh.
Earlier quoted context omitted.
Hack Club founder here. I'm so glad you know SSHTron too! I built SSHTron a few years ago at a hackathon. It served as the inspiration for jobs.hackclub.com. The code for both is open source, at https://github.com/zachlatta/sshtron and https://github.com/hackclub/jobs respectively.
Massive kudos, SSHTron has to be one of the coolest hacks I've seen. Really enjoyed playing for 10 minutes or so :D