Re: [9fans] SSH Version2

["Russ Cox" <rsc@plan9.bell-labs.com>]

> on the comment about ssh2, it was made more complicated specifically so
> it would be harder to break, and said theory has held true because as

NO NO NO.  It happened to be made more complicated.
Things that are more complicated are not necessarily harder
to break, and often easier to break.  Making it more
complicated was very likely not a design goal.

> you said yourself, the ettercap guys havent figured it out yet. i want it

Not true.  The ettercap guys haven't implemented it yet.
That's not the same as haven't figured it out yet.
The MITM attack remains the same.  They haven't implemented SSH2
support, just like we haven't.  This is very VERY different.

> to be difficult for someone to get my username and password, impossible
> is not an option yet, but one can certainly make it more difficult.

Impossible _is_ an option (modulo the attacker just happening to guess
the right password or key, which is unavoidable).

Also, don't use SSH in password mode.  Use it with public keys
or with challenge/response.  Not as good as PAK, but much better
than sending a password.

> network you trust (or are ignorant of). the idea behind ssh and all other
> tools like it, is so you can work on a network you dont entirely trust,
> if we always trusted networks we'd use telnet.

There's a difference between working on a network you don't entirely
trust and working on a network that is a complete unknown to you.
If you're that paranoid, just get the host keys via an out-of-band
mechanism, and you'll never have a problem.

I mean, come on.  What kind of paranoid are you if you ignore messages like:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA1 host key has just been changed.
The fingerprint for the RSA1 key sent by the remote host is
2e:0e:82:ba:a3:d0:00:9a:ba:6d:87:e3:e0:b6:22:88.
Please contact your system administrator.
Add correct host key in /home/ny3/rsc/.ssh/known_hosts to get rid of this message.
Offending key in /home/ny3/rsc/.ssh/known_hosts:33
RSA1 host key for labrador.eecs.harvard.edu has changed and you have requested strict checking.
Host key verification failed.

Russ