Why aren’t we using SSH for everything? • Hacker News Board

Re: Why aren’t we using SSH for everything?

#21

Post by XorNot » Fri, Jan 02, 2015, 10:13 PM UTC

singlow wrote: post #18

forgottenpass wrote: post #13

Earlier quoted context omitted.

It can be MITM-ed on any connection. Whether you approve the host fingerprint is, and has always been, entirely up to you.

Default configuration on all of the system's I have used (mostly Ubuntu) is that you cannot just approve it. You have to actually remove it from the known hosts table, in effect starting a new "first session". You can set it to allow override without deleting the entry though and some system may have this as the default.

Which is still irrelevant: in the default configuration the server I'm connecting to is probably not compromised, I've probably just done something to change keys or routes or names or whatever.

The problem is further back: the default configuration doesn't make it easy to avoid these problems in the first place. If I'm logged in and do something which will change SSH host keys or the like, then the default needs to provide a way for me to make that information easily available globally to other clients which might be aware of this system.

Re: Why aren’t we using SSH for everything?

#22

Post by XorNot » Fri, Jan 02, 2015, 10:15 PM UTC

falcolas wrote: post #9

Neat trick, if you're so inclined to use such tricks: $ cat .ssh/authorized_keys command="tmux new-session -A -s base" ssh-rsa [...] Automatically creates or joins a tmux session named base, and disconnects the SSH session when you disconnect from the tmux session. So, yeah, why don't we use SSH for more?

It's multiplexing support uses static sized windows, which even on modern LANs means you usually only see 3-5 mb/s transfer rates where you should be able to - even with encryption overhead - achieve almost gigabit NIC speed.

Fortunately the HPN-SSH patches exist to solve this problem - but I really want to know why their's so much resistance to adding them upstream.

Re: Why aren’t we using SSH for everything?

#23

Post by _b8r0 » Fri, Jan 02, 2015, 10:29 PM UTC

forfengeligfaen wrote: post #6

If you believe Jacob Appelbaum, we probably should not be using SSH for anything http://media.ccc.de/browse/congress/2014/31c3_-_6258_-_en_-_...

If you believe that being able to sometimes compromise some implementations of SSH under some circumstances means that you shouldn't use SSH for anything then maybe you shouldn't use the Internet at all.

Re: Why aren’t we using SSH for everything?

#24

Post by blfr » Fri, Jan 02, 2015, 10:36 PM UTC

shazow wrote: post #16

forgottenpass wrote: post #12

Why aren’t we using SSH for everything? Because "Use X for everything" is a terrible design decision? SSH uses flexible transport with some desirable features and may be underutilized in practice. This question is starting to feel like people who want to staple every pie in the sky idea to the bitcoin blockchain because it too has a set of desirable properties.

You're right, we probably shouldn't use SSH to microwave our food. But a lot of things where we use HTTP today, we could be using SSH if we had better library support. Some more ideas towards the end of the post.

Someone has to be running NetBSD on their microwave owen. I remember a toaster story.

http://www.embeddedarm.com/software/arm-netbsd-toaster.php

Re: Why aren’t we using SSH for everything?

#25

Post by josephg » Fri, Jan 02, 2015, 10:36 PM UTC

Because SSH requires several seconds to initiate a session, even on a local LAN.

Does anyone know why this is the case? Its always baffled me.

Re: Why aren’t we using SSH for everything?

#26

Post by tlrobinson » Fri, Jan 02, 2015, 10:39 PM UTC

forfengeligfaen wrote: post #6

If you believe Jacob Appelbaum, we probably should not be using SSH for anything http://media.ccc.de/browse/congress/2014/31c3_-_6258_-_en_-_...

Relevant bit starts around 00:25:30

Also: https://twitter.com/ioerror/status/549327936361611264

Re: Why aren’t we using SSH for everything?

#27

Post by richardwhiuk » Fri, Jan 02, 2015, 10:42 PM UTC

higherpurpose wrote: post #11

I read somewhere that SSH can be MITM'ed by a global adversary on the first visit (before it establishes the secure connection). Is that true?

You can fix this with SSHFP records and DNSSEC.

Re: Why aren’t we using SSH for everything?

#28

Post by shazow » Fri, Jan 02, 2015, 10:44 PM UTC

josephg wrote: post #25

Because SSH requires several seconds to initiate a session, even on a local LAN. Does anyone know why this is the case? Its always baffled me.

It shouldn't take much longer than an HTTPS connection, could be something with your server configuration or latency?

Re: Why aren’t we using SSH for everything?

#29

Post by scott_karana » Fri, Jan 02, 2015, 10:44 PM UTC

josephg wrote: post #25

Because SSH requires several seconds to initiate a session, even on a local LAN. Does anyone know why this is the case? Its always baffled me.

TLS also takes some time to initiate a session, but that hasn't turned anyone off SPDY, since it supports concurrency from then onwards. :-)

Re: Why aren’t we using SSH for everything?

#30

Post by sharpneli » Fri, Jan 02, 2015, 10:49 PM UTC

SSH can really be used for almost everything. It's a different thing if it actually _should_ be used for everything.

My favourite one: http://en.wikipedia.org/wiki/SSHFS

Whenever I'm developing for my mobile phone I actually have the contents mounted on my desktop via sshfs as an actual filesystem.

What that means? Don't bother with FTP servers. ssh access to your server is all you need.