Why aren’t we using SSH for everything?

#1

Post by dkua » Fri, Jan 02, 2015, 9:05 PM UTC

Why aren’t we using SSH for everything?
medium.com

Re: Why aren’t we using SSH for everything?

#2

Post by feld » Fri, Jan 02, 2015, 9:22 PM UTC

I wonder if his chat server has been hit by a botnet yet trying to ssh in and then sending tons of shell commands

Re: Why aren’t we using SSH for everything?

#3

Post by shazow » Fri, Jan 02, 2015, 9:23 PM UTC

Sorry the title has been revised to "Why aren’t we using SSH for everything?" in case mods see this.

Re: Why aren’t we using SSH for everything?

#4

Post by 4mnt » Fri, Jan 02, 2015, 9:24 PM UTC

feld wrote: post #2

I wonder if his chat server has been hit by a botnet yet trying to ssh in and then sending tons of shell commands

That would be very interesting to watch (albeit a bit annoying for the people trying to chat)

Re: Why aren’t we using SSH for everything?

#5

Post by shazow » Fri, Jan 02, 2015, 9:28 PM UTC

feld wrote: post #2

I wonder if his chat server has been hit by a botnet yet trying to ssh in and then sending tons of shell commands

Lots of people spamming/flooding/DoS'ing "for fun", but no clueless bots stumbling in accidentally yet.

Btw previous HN thread about ssh-chat here: https://news.ycombinator.com/item?id=8743374

Re: Why aren’t we using SSH for everything?

#6

Post by forfengeligfaen » Fri, Jan 02, 2015, 9:38 PM UTC

If you believe Jacob Appelbaum, we probably should not be using SSH for anything http://media.ccc.de/browse/congress/2014/31c3_-_6258_-_en_-_...

Re: Why aren’t we using SSH for everything?

#7

Post by shazow » Fri, Jan 02, 2015, 9:40 PM UTC

forfengeligfaen wrote: post #6

If you believe Jacob Appelbaum, we probably should not be using SSH for anything http://media.ccc.de/browse/congress/2014/31c3_-_6258_-_en_-_...

Yea I was fairly confused about that announcement as I couldn't find anything damning in the released docs about SSH. Do you have a reference to a specific document/slide?

Re: Why aren’t we using SSH for everything?

#8

Post by doctorshady » Fri, Jan 02, 2015, 9:47 PM UTC

shazow wrote: post #7

forfengeligfaen wrote: post #6

If you believe Jacob Appelbaum, we probably should not be using SSH for anything http://media.ccc.de/browse/congress/2014/31c3_-_6258_-_en_-_...

Yea I was fairly confused about that announcement as I couldn't find anything damning in the released docs about SSH. Do you have a reference to a specific document/slide?

Spiegel briefly touched on it too;

The NSA also has a program with which it claims it can sometimes decrypt the Secure Shell protocol (SSH). This is typically used by systems administrators to log into employees' computers remotely, largely for use in the infrastructure of businesses, core Internet routers and other similarly important systems. The NSA combines the data collected in this manner with other information to leverage access to important systems of interest.

(source: http://www.spiegel.de/international/germany/inside-the-nsa-s... )

Still incredibly vague. If they're archiving all traffic in hopes of decrypting it some day though, it's safe to say we should treat anything on the internet as the shiny side of one way glass.

Re: Why aren’t we using SSH for everything?

#9

Post by falcolas » Fri, Jan 02, 2015, 9:47 PM UTC

Neat trick, if you're so inclined to use such tricks:

    $ cat .ssh/authorized_keys
    command="tmux new-session -A -s base" ssh-rsa [...]

Automatically creates or joins a tmux session named base, and disconnects the SSH session when you disconnect from the tmux session.

So, yeah, why don't we use SSH for more?

Re: Why aren’t we using SSH for everything?

#10

Post by falcolas » Fri, Jan 02, 2015, 9:47 PM UTC

forfengeligfaen wrote: post #6

If you believe Jacob Appelbaum, we probably should not be using SSH for anything http://media.ccc.de/browse/congress/2014/31c3_-_6258_-_en_-_...

This link 404's for me; can you give a summary?