News for hackers. Stuff that matters.
Re:Targeted MitM attacks using information leakage in SSH cl... by DangerousPie on Saturday July 04, 2020 @08:22AM (#23731785)
I'm surprised people are still using PuTTY this much. It used to be one of the first programs I'd install on any new Windows machine and has served me well for many years. But since I started using WSL I haven't needed it once.
Re:Targeted MitM attacks using information leakage in SSH cl... by toast0 on Saturday July 04, 2020 @12:10PM (#23733198)
PuTTY has been doing this job for however many years, why change?

I don't want to run a whole VM so I can ssh to a real machine. I don't trust Microsoft with providing a decent terminal experience, were I to run their ssh in their terminal. Frankly, at this point, anything new from Microsoft that does something I can already do is suspect; their new work doesn't feel polished and I'm tired of trying their broken stuff.

Re:Targeted MitM attacks using information leakage in SSH cl... by badrabbit on Saturday July 04, 2020 @10:50AM (#23732599)
You don't need WSL. Windows10 supports OpenSSH
Re:Targeted MitM attacks using information leakage in SSH cl... by asveikau on Saturday July 04, 2020 @11:55AM (#23733112)
I also use the win10 openssh. Sometimes it is not so great at terminal emulation in a way that a Unix environment will expect. For example I get frequent weird behaviors running vi. Maybe could be fixed with TERM or termcap but putty "just works".

Also I haven't seemed to be able to get ssh-agent working there. Maybe just need to look into it more.

Re:Targeted MitM attacks using information leakage in SSH cl... by btschaegg on Saturday July 04, 2020 @09:18PM (#23736015)
On the agent thing: I don't know about the OpenSSH agent, but I have KeeAgent set up and it works without a hitch in MSYS (and thus Git Bash) as well as with the SSH port of Microsoft.
Re:Targeted MitM attacks using information leakage in SSH cl... by adornedCupcake on Saturday July 04, 2020 @05:26PM (#23735018)
I set it up. As a service. Check stackoverflow.
Re:Targeted MitM attacks using information leakage in SSH cl... by Aloha on Saturday July 04, 2020 @12:38PM (#23733374)
the Windows Terminal is.. while significantly better than ever - its still not great, the lack of bell support, and you effectively need to run whatever you're doing inside screen to make curses applications run correctly.
Re:Targeted MitM attacks using information leakage in SSH cl... by badrabbit on Saturday July 04, 2020 @05:17PM (#23734971)
I use openssh from powershell. You can install it as a package or feature I believe.
Re:Targeted MitM attacks using information leakage in SSH cl... by DangerousPie on Saturday July 04, 2020 @05:09PM (#23734930)
But WSL also supports lots of other useful things!
Re:Targeted MitM attacks using information leakage in SSH cl... by vbezhenar on Saturday July 04, 2020 @08:43AM (#23731869)
I'm using PuTTY because I prefer native software. That said, it seems that Microsoft started shipping its own build of OpenSSH with Windows 10, so probably that's not needed anymore.
Re:Targeted MitM attacks using information leakage in SSH cl... by cafard on Saturday July 04, 2020 @08:48AM (#23731895)
The terminal emulation in Windows 10 isn't great. Mostly I use PuTTY instead.
Re:Targeted MitM attacks using information leakage in SSH cl... by btschaegg on Saturday July 04, 2020 @10:43AM (#23732533)
I agree about the default terminal emulation, although Microsoft's new Terminal application has improved much of it.

But I find PuTTY's terminals to be almost worse. The visuals are seriously eye cancer inducing, and PuTTY's tools don't seem to be built with a terminal-based workflow in mind.

So, I much rather use either MS' OpenSSH port (on Win10) or MSYS 2's (which is included in the Git Bash for Windows, too).

Re:Targeted MitM attacks using information leakage in SSH cl... by DarthGhandi on Saturday July 04, 2020 @11:13AM (#23732798)
Putty's absurdly small gui that isn't resizable was one of those minor things that always made my eye twitch. UX from a different age.
Re:Targeted MitM attacks using information leakage in SSH cl... by gear54rus on Saturday July 04, 2020 @02:04PM (#23733871)
Why do you need to resize it?
Re:Targeted MitM attacks using information leakage in SSH cl... by reificator on Saturday July 04, 2020 @02:14PM (#23733932)
Why do you need to change your wallpaper?
Re:Targeted MitM attacks using information leakage in SSH cl... by gear54rus on Saturday July 04, 2020 @03:33PM (#23734376)
What does this have to do with my question lol
Re:Targeted MitM attacks using information leakage in SSH cl... by westmeal on Saturday July 04, 2020 @04:14PM (#23734627)
I think he's implying that customization is pretty much something you take for granted and there is no real reason it's not in putty.
Re:Targeted MitM attacks using information leakage in SSH cl... by vbezhenar on Saturday July 04, 2020 @08:59AM (#23731935)
Why is it not great? I just opened session from cmd.exe to a Linux host and checked few things. Colors work, vim works, tmux works, arrow keys work, delete and backspace works. From a quick test the only issue I've found is input with cyrillic layout, but that's definitely not something to be concerned about.
Re:Targeted MitM attacks using information leakage in SSH cl... by lmm on Saturday July 04, 2020 @09:46AM (#23732137)
It's slow, the clipboard integration is flaky, the resize behaviour is weird. And difficulties with non-ascii input are a serious problem for some of us.
Re:Targeted MitM attacks using information leakage in SSH cl... by vbezhenar on Saturday July 04, 2020 @11:17AM (#23732817)
Not sure about speed, but clipboard integration works for me from the first glance (see my neighbor answer) and resize works, at least for vim and tmux. Non-ascii input requires more research, I think that with some additional configuration it should work.
Re:Targeted MitM attacks using information leakage in SSH cl... by bbatha on Saturday July 04, 2020 @11:55AM (#23733114)
Putty doesn’t implement 256 colors properly which is why there is so much eye bleating blue.
Re:Targeted MitM attacks using information leakage in SSH cl... by sigzero on Saturday July 04, 2020 @09:31AM (#23732076)
Not everyone has the luxury of running Linux host.
Re:Targeted MitM attacks using information leakage in SSH cl... by Macha on Saturday July 04, 2020 @09:12AM (#23732002)
How about clipboard integration?
Re:Targeted MitM attacks using information leakage in SSH cl... by vbezhenar on Saturday July 04, 2020 @11:16AM (#23732814)
To copy text, selecting and pressing <Enter> or <Ctrl>+C works. To paste, one should right-click window title and select Edit -> Paste (Ctrl+V and Shift+Insert are sent as a hotkeys to the Linux). Or just right-click terminal window.

Another approach is to enable "Use Ctrl+Shift+C/V as Copy/Paste" in terminal properties and just use those shortcuts, they seem to work fine in ssh.

Re:Targeted MitM attacks using information leakage in SSH cl... by fomine3 on Sunday July 05, 2020 @09:46PM (#23743899)
different key file format is pain.
Re:Targeted MitM attacks using information leakage in SSH cl... by metalliqaz on Saturday July 04, 2020 @01:57PM (#23733821)
Been using PuTTY since 1999 and I haven't had a reason to switch. The only thing I don't like about it is that you have to dump the registry to back up your saved sessions.
Re:Targeted MitM attacks using information leakage in SSH cl... by gear54rus on Saturday July 04, 2020 @09:42AM (#23732117)
Yeah and I'm surprised everyone forgot how much of a closed down oppressive shit windows 10 is...

Sorry, not buying into the Extend phase. Thank god for Putty and win7 combination still working.

Re:Targeted MitM attacks using information leakage in SSH cl... by drvdevd on Saturday July 04, 2020 @01:34PM (#23733690)
The issue with everything which is not PuTTY is terminal emulation bugs, in my experience. I’ve never experienced one in PuTTY or at least not noticeably. Whereas using SSH in every other Windows terminal (including the newer windows terminal emulator they’ve been working on), I eventually run into display bugs requiring me to refresh the terminal somehow, particularly in long running tmux sessions.

I believe they will get there with Windows terminal (https://github.com/Microsoft/Terminal), I just don’t think they are there yet.

Re:Targeted MitM attacks using information leakage in SSH cl... by tenebrisalietum on Saturday July 04, 2020 @11:57AM (#23733125)
PuTTY also works with telnet and serial ports. I'll never stop using it.
Re:Targeted MitM attacks using information leakage in SSH cl... by m0xte on Saturday July 04, 2020 @12:35PM (#23733359)
This. Mine is eternally used as a console for some bit of network gubbins that still has a usb serial port in it (Cisco etc)
Re:Targeted MitM attacks using information leakage in SSH cl... by ragona on Saturday July 04, 2020 @09:04AM (#23731958)
Even better, WSL isn’t required these days. There is a full version of ssh in the standard cmd terminal.

They didn’t launch it with a big splash or anything, but it has saved my butt before.

Re:Targeted MitM attacks using information leakage in SSH cl... by skrebbel on Saturday July 04, 2020 @01:16PM (#23733585)
Stupid question: while I dislike the UX of Putty's settings screen, at least it lets me load/save a bunch of hosts with default settings. How do you do that with command like ssh? Do people just remember IP addresses or something, or is there a trick I'm not aware of?
Re:Targeted MitM attacks using information leakage in SSH cl... by p49k on Saturday July 04, 2020 @01:24PM (#23733630)
You can edit the ssh/config file to create/define aliases. For each alias, you can configure the host, port, username, etc.
Re:Targeted MitM attacks using information leakage in SSH cl... by skrebbel on Saturday July 04, 2020 @01:31PM (#23733680)
Ahhh, fantastic. Somehow I was never aware of this. Will try it out, thanks!
Re:Targeted MitM attacks using information leakage in SSH cl... by xorcist on Saturday July 04, 2020 @01:25PM (#23733638)
Isn't it just regular OpenSSH, where you enter settings and aliases for hosts in ~/.ssh/config?
Re:Targeted MitM attacks using information leakage in SSH cl... by blibble on Saturday July 04, 2020 @01:27PM (#23733647)
in ~/.ssh/config:

    Host *
    (options)
Re:Targeted MitM attacks using information leakage in SSH cl... by pengaru on Saturday July 04, 2020 @07:05PM (#23735509)
You actually believe using a virtualized system just for an SSH client is somehow preferable to a native application?

In WSL2 isn't that a full-blown VM with another kernel and all? To run an SSH client? shakes head in disbelief

Re:Targeted MitM attacks using information leakage in SSH cl... by xnyan on Saturday July 04, 2020 @07:19PM (#23735562)
No need for either, windows has and OpenSSH client and server as well as pretty good terminal now.
Re:Targeted MitM attacks using information leakage in SSH cl... by leokennis on Saturday July 04, 2020 @10:30AM (#23732422)
I use Royal TS. It’s basically a MDI in which you can include many PuTTY etc. sessions. Also allows you to simultaneously perform commands on all open terminals. Handy if you administer a large set of servers.
Re:Targeted MitM attacks using information leakage in SSH cl... by _xerces_ on Saturday July 04, 2020 @11:02AM (#23732695)
I recently installed it because WSL2 can't talk to hardware, so I use it for devices connected using a USB to UART cable.
Re:Targeted MitM attacks using information leakage in SSH cl... by bluedino on Saturday July 04, 2020 @08:26AM (#23731801)
Is the terminal emulation fixed? Every time I tried to use WSL, some kind of glitch shows up when I am SSH’d into a server.
Re:Targeted MitM attacks using information leakage in SSH cl... by demosito666 on Saturday July 04, 2020 @08:44AM (#23731872)
It's not. Default wsl terminal is pretty much unusable if you need anything more complex than entering commands (read vim and tmux). You can install MinTTY terminal for wsl, but it's much more hassle then just download putty.
Re:Targeted MitM attacks using information leakage in SSH cl... by m0xte on Saturday July 04, 2020 @12:37PM (#23733367)
Yeah it’s awful. Window terminal default key bindings buggers up touch as well.

I have moved to macOS since wsl2 came out.

Re:Targeted MitM attacks using information leakage in SSH cl... by _bxg1 on Saturday July 04, 2020 @11:18AM (#23732821)
Unfortunately lots of organizations haven't switched to Windows 10 yet, despite end of support.
Re:Targeted MitM attacks using information leakage in SSH cl... by dmd on Saturday July 04, 2020 @11:44AM (#23733030)
Hello there, from an employee of a major health care network which still has a ton of Windows Server 2003 servers in production!
Re:Targeted MitM attacks using information leakage in SSH cl... by cheez on Saturday July 04, 2020 @02:39PM (#23734069)
Hello there! From someone who was asked if they still support Windows 2000.
Re:Targeted MitM attacks using information leakage in SSH cl... by nvr219 on Saturday July 04, 2020 @08:35AM (#23731829)
I use it only when I need to connect via serial