Full Disclosure mailing list archives
Re: Strength and Weakness of Methods to Confirm SSH Host Key
From: Paul Vixie <paul () redbarn org>
Date: Wed, 24 Sep 2014 22:02:52 -0700
John Leo dijo [Mon, Sep 22, 2014 at 03:51:57PM +0800]:"use DNSSEC to validate SSH fingerprints" (advice from Micha Borrmann / Jeroen van der Ham / john) This is a good solution. Weakness: HTTPS is more mature than DNSSEC(in my personal opinion).
That's a truth but not nec'ily a weakness. RLOGIN is more mature than SSH, but, I prefer SSH every time I get a choice. DNSSEC mostly doesn't work, since EDNS mostly doesn't work, since UDP fragmentation of DNS mostly doesn't work. So, deployment (lack of) could be called a weakness, except: in our community (readers of and contributors to fulldisclosure@ and bugtraq@), DNSSEC mostly does work, because we are mostly on networks controlled by competent well informed modern technologists. So, in my personal opinion, we ought to pile on the DNSSEC bandwagon for SSHFP support, as our way to make SSH key confirmation more secure. (Right now most of us don't even read the hex, we just say Yes.) -- Paul Vixie _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Strength and Weakness of Methods to Confirm SSH Host Key John Leo (Sep 23)
- Re: Strength and Weakness of Methods to Confirm SSH Host Key Gunnar Wolf (Sep 24)
- Re: Strength and Weakness of Methods to Confirm SSH Host Key Paul Vixie (Sep 24)
- Re: Strength and Weakness of Methods to Confirm SSH Host Key Gunnar Wolf (Sep 24)