If I understand this correctly, the idea here is to think of a
solution like Java, which is downloaded from a remote server
every time, and which handles security for the user.
My opinion is that Java based systems are fine, but if you
REALLY don't trust the client, there is absolutely no way
with our current capabilities to guarantee security for the
user if they are using an untrusted machine.
My reasoning is that since the machine could have a
background process (such as one of several popular
password capturing programs) which reads all input before
passing it on to the program in use (e.g. trusted email
program), entering data to the machine would be like sending
email to the owner of the machine. If the machine's
owner is a bad guy, you are in effect allowing
the bad guy to see what you writing.
Anyway,
Troy
Troy Korjuslommi Tksoft OY, Inc.
[EMAIL PROTECTED] Software Development
Open Source Solutions
Hosting Services
>
> [ On Tuesday, February 2, 1999 at 03:51:08 (-0800), Joe Rhett wrote: ]
> > Subject: transfering files back along an existing connection
> >
> > Yes. And ssh-agent just doesn't work if you can't trust the system you are
> > accessing FROM ...
>
