I feel like the title is missing a "malicious" somewhere :p
Anyways, I keep being surprised that people do password authentication for SSH. That seems like opening yourself up to a lot of potential trouble for little to no benefit (but see cks's Thoughts on having SSH allow password authentication from the Internet). I wish it wasn't enabled by default :/
Actually, wasn't there a way to set up OpenSSH to use PAKE or something similar? I thought I remembered seeing something about that, but I skimmed sshd_config(5) and didn't see anything about that. That wouldn't really be a good solution - you'd need to configure your client to disallow regular password auth and automatic (pubkey/anonymous) logins, so at that point you might as well just use public key auth. Still, it'd at least be interesting.
dzwdz | 36 minutes ago
I feel like the title is missing a "malicious" somewhere :p
Anyways, I keep being surprised that people do password authentication for SSH. That seems like opening yourself up to a lot of potential trouble for little to no benefit (but see cks's Thoughts on having SSH allow password authentication from the Internet). I wish it wasn't enabled by default :/
Actually, wasn't there a way to set up OpenSSH to use PAKE or something similar? I thought I remembered seeing something about that, but I skimmed sshd_config(5) and didn't see anything about that. That wouldn't really be a good solution - you'd need to configure your client to disallow regular password auth and automatic (pubkey/anonymous) logins, so at that point you might as well just use public key auth. Still, it'd at least be interesting.