News for hackers. Stuff that matters.

A comment on Targeted MitM attacks using information leakage in SSH clients [pdf]. Parent comment

Re:Targeted MitM attacks using information leakage in SSH cl... by gnu8 on Saturday July 04, 2020 @02:08PM (#23733893)
Everyone recognizes that URL. It would be more suspect to download PuTTY from anywhere else.
[ Parent | on HN ]
Re:Targeted MitM attacks using information leakage in SSH cl... by pmoriarty on Saturday July 04, 2020 @02:31PM (#23734037)
As an infrequent user of PuTTY, I don't recognize that URL. So I guess I'm not part of the "everyone" you're talking about.

On the other hand, I think it's absolutely ridiculous to base one's security around URL recognition, considering all the possible attacks against domain names and URLs.

Cryptographic signatures in a web of trust would be a big step forward here, but unfortunately relatively few people participate.

[ Parent | on HN ]
Re:Targeted MitM attacks using information leakage in SSH cl... by gruez on Saturday July 04, 2020 @06:05PM (#23735249)
> Everyone recognizes that URL. It would be more suspect to download PuTTY from anywhere else.

that that to everyone who downloaded from putty.org

[ Parent | on HN ]
Re:Targeted MitM attacks using information leakage in SSH cl... by maxheadrum on Saturday July 04, 2020 @02:27PM (#23734014)
I recognize the general pattern of the URL but if you changed a character here or there I wouldn't notice it.
[ Parent | on HN ]