News for hackers. Stuff that matters.

A comment on Observations from two weeks of SSH brute force attacks. Parent comment

Re:Observations from two weeks of SSH brute force attacks by gnosis on Friday January 27, 2012 @06:48AM (#3517954)
"If your key is on a smart card it can not be stolen, even if the machine you're ssh'ing from has been compromised."

If the machine you're ssh'ing from has been compromised by a halfway competent attacker, there's no need for them to get the key from the smart card. They can log in to the remote machine by simply piggybacking on to your ssh session (with a compromised ssh client).

[ Parent | on HN ]
Re:Observations from two weeks of SSH brute force attacks by mike-cardwell on Friday January 27, 2012 @07:02AM (#3517971)
Of course. There is still significant value in not allowing the attacker to ssh at will from any box at any time though.
[ Parent | on HN ]