On Thu, 6 Jul 2000, Benjamin Scott <[EMAIL PROTECTED]> wrote:
>
> Hmmm. AFAIK, simply having telnet open isn't insecure. It is using telnet
> -- specifically, logging in with your password in the clear -- that makes you
> vulnerable to sniffed passwords. SSH will help prevent that.
>
> However, simple SSH session encryption won't protect against
> man-in-the-middle attacks, and it is still vulnerable to brute force attacks
> and weak passwords.
>
> Only SSH with mutual public/private key authentication is truly secure
> against all known attacks.
Some people I've met hesitate to switch from Telnet to SSH because they
are, say, on the road a lot and don't know what machine they will be
connecting back from. Since even Win9* now ships with a telnet client
they know they can telnet in easily (rather than downloading/installing
a ssh client).
One could easily get around that by carrying around a floppy disk with
some ssh binaries on it, but here is an even niftier way around the problem:
http://www.mindbright.se/mindterm/
Mindterm is a Java applet implementation of a SSH client. So if the ssh
host is also serving web pages, you just plunk down the mindterm in
some (possibly obscure) place in the web directories. Then you just
have to type in a URL in any java enabled browser to establish a secure
SSH connection back home!
I set up mindterm for some friends. It's pretty easy.
Karl
**********************************************************
To unsubscribe from this list, send mail to
[EMAIL PROTECTED] with the following text in the
*body* (*not* the subject line) of the letter:
unsubscribe gnhlug
**********************************************************
