[EMAIL PROTECTED] on 05/31/2000 11:13:31 AM
>> SSH will be more secure against those not knowing how to spoof
>> usernames and against those giving their keys away if it can limit
>> the use of keys only to specific users.
>
>A client username check is nearly or totally useless for RSA
>authentication; you have no assurance that the client username is
>accurate (if it is even provided by the protocol with RSA
>authentication). A hostname check is potentially useful if done
>carefully (i.e. without trusting PTR records in the DNS), since it's
>mildly hard to spoof TCP and DNS. But it's still not very strong.
You said it yourself. You have no assurance that the hostname hasn't been
spoofed although you do make it that much more difficult. I'm saying the same
can be said of a username check -- you have no assurance of its validity, but
you make it that much harder for (at least a beginner) hacker (eg a computer
illiterate employee).
>> Looking at it from another view, will such a patch /decrease/ SSH
>> security?
>
>Yes, it will. Any increase in the complexity of a security system
>decreases its security. Maybe this patch wouldn't immediately add
>vulnerabilities to ssh, but it would incrementally decrease the
>maintainers' ability to prevent vulnerabilities in the future.
Again, the same can be said of the hostname check -- it adds complexity without
really assuring anything.
Noel
This communication is for informational purposes only. It is not intended as
an offer or solicitation for the purchase or sale of any financial instrument
or as an official confirmation of any transaction. All market prices, data
and other information are not warranted as to completeness or accuracy and
are subject to change without notice. Any comments or statements made herein
do not necessarily reflect those of J.P. Morgan & Co. Incorporated, its
subsidiaries and affiliates.
