News for hackers. Stuff that matters.

A comment on OpenSSH 7.3 released. Parent comment

Re:OpenSSH 7.3 released by schmichael on Monday August 01, 2016 @01:58PM (#12204493)
Unless you've gotten anoncvs.ca.openbsd.org's host key fingerprint through some secure mechanism (say... HTTPS), SSH only encrypts the transport. It does nothing to stop a MITM (eg a malware injecting proxy).
[ Parent | on HN ]
Re:OpenSSH 7.3 released by OrpheanBeholder on Monday August 01, 2016 @03:35PM (#12205244)
Get the host fingerprints over TLS then?

https://www.openbsd.org/anoncvs.html

[ Parent | on HN ]
Re:OpenSSH 7.3 released by jlgaddis on Monday August 01, 2016 @06:49PM (#12206666)
In which case ISTM that they could have just enabled HTTPS on www.openssh.com and saved us a few steps.
[ Parent | on HN ]