News for hackers. Stuff that matters.

A comment on SSH3: SSHv2 using HTTP/3 and QUIC. Parent comment

Re:SSH3: SSHv2 using HTTP/3 and QUIC by egberts1 on Saturday December 16, 2023 @02:50PM (#38667140)
From the Github:

SSH3 is a complete revisit of the SSH protocol, mapping its semantics on top of the HTTP mechanisms. In a nutshell, SSH3 uses QUIC+TLS1.3 for secure channel establishment and the HTTP Authorization mechanisms for user authentication.

So, it has nothing to do with SSH2; more about HTTP/3-QUIC security theater: hostname is still being sent over TLS/1.3 negotiation.

[ Parent | on HN ]
Re:SSH3: SSHv2 using HTTP/3 and QUIC by insanitybit on Saturday December 16, 2023 @04:29PM (#38667880)
To be clear, my reading of the parent post is that the grandparent doesn't like HTTP/3-QUIC making it harder to read data off of the wire (ie: for internal security analytics).

But I don't see how this is worse than SSHv2. In both cases retrieving the hostname / IP is obviously trivial since you just instrument DNS for the hostname and, of course, the IP is cleartext.

[ Parent | on HN ]