News for hackers. Stuff that matters.

A comment on Keystroke timing obfuscation added to SSH(1). Parent comment

Re:Keystroke timing obfuscation added to SSH(1) by glitchc on Tuesday August 29, 2023 @01:25PM (#37311083)
This is naive in the extreme. There are many scenarios where passwords are needed, for bootstrapping, a disgruntled admin leaving, etc.

There is a role for a common secret in a secure ecosystem (password, passkey)

[ Parent | on HN ]
Re:Keystroke timing obfuscation added to SSH(1) by scarby2 on Tuesday August 29, 2023 @01:34PM (#37311200)
That common secret is usually an ssh key which is held somewhere secure hopefully with auditable access.

For bootstrapping you can bake a bootstrapping key into your installer which is removed after the system is configured.

[ Parent | on HN ]