Hacker News new | past | comments | ask | show | jobs | submit login

In most cases, no real harm. However, it does give away some information about you which can be used to fingerprint you. This data is also, I'm 99% sure, transmitted in plaintext, so a passive adversary can gather this information as well. For most uses I wouldn't worry about it. But, if you're an attacker, say forcing your way onto an SSH server with a weak password, it can be a valuable source of information for identifying you.



> This data is also, I'm 99% sure, transmitted in plaintext

I was curious about this, so I did some research.

First, if you run `ssh -v`, you can see that there's a key exchange (eg, Diffie-Hellman), then a cipher and MAC are negotiated, and only once you get to the user authentication portion do your public keys get sent to the server.

So, only Alice and Bob can see the public keys: not Mallory.

Further reading: SSH transport layer, https://tools.ietf.org/html/rfc4253


Ah yes, you're right! I remembered there is some stuff transmitted in plaintext at the beginning, but it's just the normal SSL cipher-suite negotiation.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: