111–120 of 126 posts
So cool! If I wanted to make a similar product, how should I do it? Do you have any advice or research directions? I saw a company using SSH for hiring a couple of days ago, and I thought it was really cool. I also want to build something similar.
Earlier quoted context omitted.
There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox…
Web browsers are generally built with security in mind. Terminal emulators surely much less so. The OpenSSH client probably sits somewhat in between, generally developed with security in mind, but not necessarily consistently expecting malicious servers.
Earlier quoted context omitted.
People understand that such "reverse hacking" can happen when their browser connects to any site (including all the indirect connections from dependent resources), right? Or when resolving any domain name? Or when even just pinging an IP? The risk is far, far lower than browsing the internet. Unlike the massive surface of a browser and all the libraries and processes it is comprised of, the OpenSSH client is a tiny,…
There's also the terminal to consider, via terminal escape sequences.
For comparison, the surface exposed by your browser rendering this text controlled entirely by an adversary (me) is considerably greater as it also interacts with the style system, content reflow, javascript engine (even for non-javascript websites), etc.
Earlier quoted context omitted.
Web browsers are generally built with security in mind. Terminal emulators surely much less so. The OpenSSH client probably sits somewhat in between, generally developed with security in mind, but not necessarily consistently expecting malicious servers.
At least for the more prominent terminal emulators i expect they probably devote a great deal of attention to security. They are developing the most commonly used interfaces for linking the most numerous, varied, and/or critical systems on the planet.
Went to Alacritty. No mentions of security.
Went to Ghostty. No mentions of security, except for "secure keyboard entry".
None have a "security policy" on GitHub.
All written in memory unsafe languages (C, Zig).
Time for your regular reminder that ssh has no PKI and is trivial to mitm during tofu.
SSH does in fact have a PKI, just not a global one. Large-fleet SSH installs all tend to use certificate authorities, for this reason (and to simplify SSO).
When I last harassed Crawshaw about this and we discussed bits, he submitted https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts....
Unfortunately neither of us has taken time (AFAIK) to go back and implement it anywhere.
Earlier quoted context omitted.
SSH does in fact have a PKI, just not a global one. Large-fleet SSH installs all tend to use certificate authorities, for this reason (and to simplify SSO).
Fair! When I last harassed Crawshaw about this and we discussed bits, he submitted https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts.... Unfortunately neither of us has taken time (AFAIK) to go back and implement it anywhere.
Earlier quoted context omitted.
Fair! When I last harassed Crawshaw about this and we discussed bits, he submitted https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts.... Unfortunately neither of us has taken time (AFAIK) to go back and implement it anywhere.
I don't understand the impulse behind these things --- this is a bootstrap mechanism for a global PKI for SSH. But cold introductions to SSH hosts (that is, first connections to hosts you have no business or technical relationship with) virtually never happen. What problem does it solve?
Earlier quoted context omitted.
Is that more likely than getting hacked when visiting a website?
Are we all pretending we have no empirical data on this? How many RCEs has there been in popular web browsers over the past two decades (dozens? hundreds?), compared to how many RCEs there has been in the OpenSSH client (perhaps we can make it one if we include xterm in that)?
Regarding empirical data, that would certainly be interesting, not sure if RCE is the only category one would look at in that case.