News for hackers. Stuff that matters.

A comment on Targeted MitM attacks using information leakage in SSH clients [pdf]. Parent comment

Re:Targeted MitM attacks using information leakage in SSH cl... by gruez on Saturday July 04, 2020 @02:24PM (#23734000)
It's an intentional design decision. Unlike https, ssh doesn't typically use x509 certificates for authentication, so there's no real way to know whether you're MITM if you're making a connection for the first time.
[ Parent | on HN ]
Re:Targeted MitM attacks using information leakage in SSH cl... by tptacek on Saturday July 04, 2020 @07:15PM (#23735550)
Modern SSH of course does support certificates --- SSH certificates aren't X.509 --- which solve this problem, the key management problem, and the long-term SSH key hazmat problem. Probably, SSH certificates are what we should have been using all along.
[ Parent | on HN ]
Re:Targeted MitM attacks using information leakage in SSH cl... by RL_Quine on Saturday July 04, 2020 @04:02PM (#23734553)
SSH supports things like pinning the key in a DNSSEC response.
[ Parent | on HN ]