Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why aren’t we using SSH for everything?

medium.com

Post reply on HN
Print view View original

51–60 of 105 posts

Re: Why aren’t we using SSH for everything?

#51

Post by marcosdumay »

shazow wrote: post #7
forfengeligfaen wrote: post #6

If you believe Jacob Appelbaum, we probably should not be using SSH for anything http://media.ccc.de/browse/congress/2014/31c3_-_6258_-_en_-_...

Yea I was fairly confused about that announcement as I couldn't find anything damning in the released docs about SSH. Do you have a reference to a specific document/slide?

The slides say they can sometimes decrypt SSH sessions (with ssmintm?) and catpute usernames and passwords from SSH servers.

The only unexpected thing I could see there was the lack of anything I didn't know how to do...

Re: Why aren’t we using SSH for everything?

#52

Post by otterley »

For one thing, SSH performance for large transfers is abysmal over high-latency links. SSH uses a small TCP window size because it was optimized for quick response, not bulk transfers. (After all, it was designed to be a remote shell protocol, not a generic file transfer protocol; scp and sftp were added after the fact.) And unfortunately you can't currently specify a different buffer size even if you wanted to.

More information can be found here: http://www.psc.edu/index.php/hpn-ssh

Re: Why aren’t we using SSH for everything?

#55

Post by shazow »

marcosdumay wrote: post #51
shazow wrote: post #7

Earlier quoted context omitted.

Yea I was fairly confused about that announcement as I couldn't find anything damning in the released docs about SSH. Do you have a reference to a specific document/slide?

The slides say they can sometimes decrypt SSH sessions (with ssmintm?) and catpute usernames and passwords from SSH servers. The only unexpected thing I could see there was the lack of anything I didn't know how to do...

Yea, sshmitm makes sense also, but I wouldn't consider that a 0day exactly. :P

Re: Why aren’t we using SSH for everything?

#56

Post by scrollaway »

shazow wrote: post #16
forgottenpass wrote: post #12

Why aren’t we using SSH for everything? Because "Use X for everything" is a terrible design decision? SSH uses flexible transport with some desirable features and may be underutilized in practice. This question is starting to feel like people who want to staple every pie in the sky idea to the bitcoin blockchain because it too has a set of desirable properties.

You're right, we probably shouldn't use SSH to microwave our food. But a lot of things where we use HTTP today, we could be using SSH if we had better library support. Some more ideas towards the end of the post.

Indeed. And more generally, using some of the SSH concepts on the web such as public key authentication.

Re: Why aren’t we using SSH for everything?

#59

Post by TylerE »

throwaway593 wrote: post #58

> Why aren’t we using SSH for everything? Because it doesn't support virtual hosts. And I can't afford 30 IPs for my server. Otherwise, it's a great protocol.

Couldn't you use the same IP and different ports? There's nothing magic about port 22 - and in fact on production servers you should almost certainly change 22 to something else.

Re: Why aren’t we using SSH for everything?

#60

Post by Shish2k »

ashish01 wrote: post #57

Would be great to do this for mosh - mosh-chat It improves over SSH by handling intermittent network connections.

mosh isn't a data stream tool like ssh though, it's actually more like VNC -- the reason it performs better is that it sends snapshots of the terminal over UDP, allowing random packets to be dropped
Post reply on HN