Re:Cockpit – Administer Linux servers via a web browser
by briffle on Friday February 23, 2018 @11:10AM
(#16447174)
the part that gets me is that key based authentication is much, much more secure, as long as you have a passphrase. How many 'howtos' and other sites on the internet say to just create a key with no passphrase? Its right up there with the number of guides I see for deploying things on Redhat, that first have you disable selinux.
[ Parent
| on HN ]
Re:Cockpit – Administer Linux servers via a web browser
by freehunter on Friday February 23, 2018 @11:17AM
(#16447224)
Yeah as someone who works in the security industry, the ubiquity of security awareness targeted at end users is both a blessing and a curse. It's a blessing because now many more people know what key-based authentication is. It's a curse because now people get mad when my report has a finding that their no-passcode single key authentication system is worse than the "use your RSA token to check out the constantly-revolving root password" system they just replaced.
Like when people use the phrase "two-factor authentication" without knowing what the three factors actually are and why they matter.