Signing .jars is not worth the effort

Re:Signing .jars is not worth the effort by MaxBarraclough on Sunday July 26, 2020 @03:19PM (#23959430)

> The attacker can’t perform an useful MiTM attack on the connection no matter what key you accept from the server.

True, thanks to public key crypto.

> At best the attacker could let you log into their server

This is another way of saying the machine you end up trusting could be under the control of an attacker. So yes, that's a serious concern.

> presumably you’d notice that you’re logged into the wrong server

Not if it's a fresh Ubuntu instance. Even if not, I'd expect SSH security to answer that definitively, on principle. SSH shouldn't be any sloppier than HTTPS.

[ Parent | on HN ]

Re:Signing .jars is not worth the effort by DangitBobby on Sunday July 26, 2020 @03:37PM (#23959572)

Maybe I'm being naive here, but if you spin up a new instance and immediately SSH into that via the given public IP, isn't the likelihood that someone could have meaningfully injected themselves between you and that previously unknown IP address vanishingly small?

[ Parent | on HN ]

Re:Signing .jars is not worth the effort by lysium on Sunday July 26, 2020 @04:28PM (#23959941)

Just monitor and mitm all ssh connections. It’s really easy.

[ Parent | on HN ]

Re:Signing .jars is not worth the effort by MaxBarraclough on Sunday July 26, 2020 @05:17PM (#23960262)

Right. The attacker might have compromised my local network, for instance.

[ Parent | on HN ]